Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/zhuanggenhua/BoardGamenpx agentmods add skills/zhuanggenhua/boardgame/android-app-releaseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhuanggenhua/boardgame/android-app-release)<a href="https://agentmods.dev/skills/zhuanggenhua/boardgame/android-app-release"><img src="https://agentmods.dev/badge/skills/zhuanggenhua/boardgame/android-app-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhuanggenhua/boardgame/android-app-release"><img src="https://agentmods.dev/badge/skills/zhuanggenhua/boardgame/android-app-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.02738 |
| Opus 5 | $0.00022 | $0.01369 |
| Sonnet 5 | $0.00009 | $0.00548 |
| Haiku 4.5 | $0.00004 | $0.00274 |
Grade A, and why
android-app-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 238 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Android App 发布 Skill
触发
用户提到以下任一目标时使用本 skill：
- 打 APK / AAB、发布 native、发布 OTA。
- 更新网站下载 App 入口。
- “更新部署 / 部署最新 / 发线上”。
- 排查旧包、测试包、大包、旧壳不自动更新、OTA 无法读取。
先读：
目标裁决
先把用户目标拆成交付矩阵：server / OTA / native APK / game package / device 分别是否要做。没有这张矩阵，不开始发布。
默认口径：
- “更新网站下载的 App / 发原生更新”默认走 native 发布，不部署网站。
- “只改 H5 内容”走 OTA，不顺手 bump 原生版本。
- “改原生壳、插件、权限、系统栏、返回键、方向映射、网站下载 APK”走 native。
- “更新部署 / 部署最新 / 发线上”默认包含服务器生产部署 + Android stable OTA；除非用户明确排除 OTA。
- 真机安装只在用户明确要求设备验收时做；线上修复默认回到正式 OTA/native 发布链和线上回查。
硬规则
- 本地构建成功只证明本地产物 OK；目标包含上传、发包、下载入口或旧壳更新时，必须继续发布、回查线上 manifest、下载线上 APK 验包。
- 对外发布与用户明确要求的真机验收必须使用正式壳：
appId = top.easyboardgame.app，appName = 易桌游。debug / qa / dev 壳都是失败产物，除非用户明确要求并存测试包。 latest.json只能证明入口指向；不能证明 APK 内部是正式壳。发布后必须下载latest.json.url指向的 APK 并检查 appId / appName。- Android native 自动更新比较
versionCode；旧设备不会把更低 versionCode 当更新。展示版本和原生递增版本码必须分开处理。 - OTA 发布真相源必须是已推送 git ref；本地无关脏改不阻塞指定 ref 的 OTA，但不得混入本次发布。
- 服务器部署版本、OTA 包版本、商业产品版本和原生壳版本必须分开：服务器看 git ref / 镜像，OTA 在上传时生成或显式传版本，商业产品版本只在正式产品发布时调整，原生壳版本只在 native 发布时递增。
- Android 所有 OTA channel 必须
forceUpdate: true；--no-force-update或等价关闭入口必须拒绝。 - OTA 清单读取失败不得静默当作“没有更新”；网络、CORS、超时、非 2xx、内容类型错误、JSON 解析失败都必须显式暴露。
- Docker 镜像构建、Android stable OTA、native workflow 和部署整步上限统一按 30 分钟处理；超时必须失败，不得后台假卡死。
包体边界
public/assets/** 只允许正式运行时资源。
Android embedded APK 可以保留经过白名单确认的最小首装/离线资源。OTA zip 不得复用 embedded 白名单，禁止进入 OTA：
public/assets/common/audio/**public/assets/common/images/**public/assets/atlas-configs/**public/assets/i18n/**下除assets-manifest.json外的图片、音频和运行时配置public/logos/**- 参考图、预览图、生成图、中间产物
OTA 只允许 H5 代码、样式、locales/zh-CN/**、字体、必要小型公共文件和 assets-manifest.json。包体异常变大时，先查 public/assets/** 和 dist/，不要先猜 CDN、缓存或签名。
路径选择
OTA
只改 H5 内容：
node scripts/mobile/release-android.mjs ota --channel stable
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 238 lines · 44 tokens per session scan A 1fa174645e7a
android-app-release is a skill published in the GitHub repository zhuanggenhua/BoardGame (23 stars, last pushed yesterday), licensed MIT. It adds 44 tokens to every session and 2,738 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
axiom-shipping
Use when preparing ANY app for submission, handling App Store rejections, writing appeals, or managing App Store Connect. Covers submission checklists, rejection troubleshooting, metadata requirements, privacy manifests, age ratings, export compliance.
asc-ad-hoc-distribution
Prepare, publish, resume, and verify private iOS release-testing installs with asc distribute. Use when distributing an IPA to registered devices outside TestFlight, reconciling ad hoc profiles, publishing through caller-owned S3-compatible storage, or diagnosing a resumable private distribution run.
release-new-version
Use when the user wants to release a new Zafiro version — drafting bilingual release notes, deciding the next version number, bumping app/build.gradle.kts, tagging, and publishing to GitHub (main repo, optionally the Xposed repo).
suede-play-release
Suede Labs Google Play delivery skill: ship an Android release end to end from the agent interface, without opening the Play Console. Set up credentials, upload an AAB, promote between tracks, stage or complete a rollout, push per-locale release notes, and prove against the Play Developer API what is actually live.…
testflight-release
Ship a new TestFlight build of the iOS companion (TermioMobile) — resolve the next build number against App Store Connect, archive, sign, export, upload, write the What to Test notes, and distribute. Invoke when the user says 'ship a testflight build', 'update testflight', 'upload to testflight', 'new beta build'…
app-release
End-to-end pipeline for releasing an iOS / watchOS app to TestFlight and the App Store. Use when the user wants to publish, ship, or release an iOS/watchOS app, get a build onto TestFlight, archive and upload via xcodebuild, deploy a CloudKit schema to Production, set App Privacy or export compliance, mint a…