New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Release

by guardana in guardana/guardana

Cut a Guardana release without repeating the mistakes previous releases made — a tag pushed before CI was green, a stale cache that hid a red build, a manual doc step nobody remembered, a script…

Apache-2.0Auto-check passedSecurity

Install Release

skills CLI
$ npx skills add guardana/guardana --skill release -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install guardana/guardana release --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/guardana/guardana.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/release .claude/skills/release && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
release
GitHub stars
129
Token cost
~921 tokens
SKILL.md length
521 words
Files
1
Skills in repo
16
Repo updated
First seen
Licence
Apache-2.0

At a glance

Cut a Guardana release without repeating the mistakes previous releases made — a tag pushed before CI was green, a stale cache that hid a red build, a manual doc step nobody remembered, a script…

  • Works in 5 steps: scripts/ci_local.sh --quiet — every CI… → bump, regenerate, roll the changelog,… → push main only (the hook checks the site… → …
  • Asked to release
  • SKILL.md covers The order that matters, Before the bump, Never attribute anything to an… and After the tag
  • Calls gh and docker

What it does

Release is an agent skill from guardana/guardana. Cut a Guardana release without repeating the mistakes previous releases made — a tag pushed before CI was green, a stale cache that hid a red build, a manual doc step nobody remembered, a script that runs the whole gate when asked for --help. Use when asked to release, tag, publish or bump a version.

Its SKILL.md is about 920 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Failing and flaky tests and Prompt injection and agent security. The repository describes itself as: Open-source AI security verification for model artifacts, live endpoints, MCP servers, and recorded agent traces. Reproducible evidence for release decisions. The licence is Apache-2.0.

When your agent uses it

  • Asked to release
  • Tasks that involve Failing and flaky tests
  • Tasks that involve Prompt injection and agent security

Example prompts

  • “/release”

Requirements

  • Docker

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. scripts/ci_local.sh --quiet — every CI job including the clean-install check, the SBOM
  2. bump, regenerate, roll the changelog, commit;
  3. push main only (the hook checks the site is in sync — the push deploys it);
  4. wait for CI to conclude green on that exact commit — read the steps, not the job;
  5. only then push vX.Y.Z and the moving vX.Y (the hook asks before any tag push).

What it can do on your machine

Read from SKILL.md and the folder at commit ae7ee8b. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • gh
    • docker

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use gh and docker, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Release loads about 921 tokens when it runs. Until then it costs about 77 tokens; SKILL.md has 521 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~77
When it runs · the whole SKILL.md, loaded when a task matches
~921

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from guardana/guardana at commit ae7ee8b, republished under its Apache-2.0 licence (© guardana). 521 words, ~921 tokens.

Download SKILL.mdSave it as .claude/skills/release/SKILL.md (or your agent's skills folder).
name
release
description
Cut a Guardana release without repeating the mistakes previous releases made — a tag pushed before CI was green, a stale cache that hid a red build, a manual doc step nobody remembered, a script that runs the whole gate when asked for --help. Use when asked to release, tag, publish or bump a version.
argument-hint
[patch | minor | major | X.Y.Z]

Cutting a release

Part: $ARGUMENTS. RELEASING.md is the runbook and it is correct. This is the part that is about what has actually gone wrong, three times.

The order that matters

Never push the branch and the tag together. Pushing the tag starts the PyPI publish, which waits on the pypi environment for a human approval click. If CI on the same commit then turns red, the maintainer has to cancel a run that is already waiting, fix, re-tag, and approve a second time — and the cancelled run stays in the history looking like a failed release. Worse: cancelling does not undo an upload. A cancelled Release run has already published two of the five packages from a red commit. Do not move a tag after anything has been published.

So:

  1. scripts/ci_local.sh --quiet — every CI job including the clean-install check, the SBOM check and the image smoke; read every verdict line, nothing NOT RUN;
  2. bump, regenerate, roll the changelog, commit;
  3. push main only (the hook checks the site is in sync — the push deploys it);
  4. wait for CI to conclude green on that exact commit — read the steps, not the job;
  5. only then push vX.Y.Z and the moving vX.Y (the hook asks before any tag push).

scripts/release.py <part> does 1–5 in that order and refuses to push the tag when it cannot check CI — "could not tell" is treated as "no". --help prints its usage and does nothing else. Preview with --dry-run.

Show full SKILL.md (274 more words)Show less

Before the bump

Read the open GitHub alerts, at the start of the cycle and again before the release commit: gh api 'repos/guardana/guardana/code-scanning/alerts?state=open' (CodeQL) and gh api 'repos/guardana/guardana/dependabot/alerts?state=open', beside the open Dependabot PRs. Fix a real alert in code; it closes as fixed once main is scanned. Dismissing one on GitHub is the owner's call — ask once, with a recommendation and the reason you would give.

bump_version.py rewrites every pin and version marker it can discover, and it refuses to run if a required marker has gone missing. What it cannot write is prose:

  • ROADMAP.md — "What ships today (X.Y.Z)", and delete what shipped from the milestone;
  • CHANGELOG.md — the [Unreleased] heading rolled to ## [X.Y.Z] - DATE — <one line saying what this release is>; release.py has lost the title before, check it after running.

Then the five documentation places (/docs) once more for the release as a whole, and generate_docs.py, sync_site.py, build_site.py, generate_llms_txt.py — each has --check and each is a CI gate.

Never attribute anything to an AI

No Co-Authored-By:, no "generated with", no AI name in a commit message, a tag message, a PR body or a release note. Check the last line of the message rather than assuming.

After the tag

Verify against PyPI's API rather than from memory — all five packages, at the new version — and ghcr.io for both images. A release is not done because the workflow went green; it is done when the artifacts are there. After the first release that pushes images, make the two packages public (docs/maintainers/github-setup.md); verify with docker logout ghcr.io first. Then docs/work/ is empty, the work files are closed, and ROADMAP.md no longer lists what just shipped.

© guardana, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .claude/skills/release of guardana/guardana.

Open the folder on GitHubat commit ae7ee8b

Compare with similar skills

Release next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Release compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Release this skillguardana/guardana129—~921Automated safety check: PassApache-2.0
Skill Scannergetsentry/skills1k4 repos~2.5kAutomated safety check: WarnApache-2.0
Forensifyalexgreensh/repo-forensics188—~2.5kAutomated safety check: NotesCustom licence
Hol Guardhashgraph-online/hol-guard815—~542Automated safety check: PassApache-2.0
Kesekit Checkcdppcorp/KESE-KIT361—~1.3kAutomated safety check: PassMIT
Setuphashgraph-online/hol-guard815—~443Automated safety check: PassApache-2.0

Similar skills

  • Skill Scanner

    getsentry/skills

    Official

    Scan agent skills for security issues. An agent skill from getsentry/skills.

    1k GitHub starsUsed in 4 repos~2.5k tokens
    SecurityAuto-check: warnings

  • Forensify

    alexgreensh/repo-forensics

    Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.

    188 GitHub stars~2.5k tokensUpdated 11 days ago
    SecurityAuto-check: notes

  • Hol Guard

    hashgraph-online/hol-guard

    Run HOL Guard scanner and guard operations via uv run hol-guard.

    815 GitHub stars~542 tokensUpdated today
    SecurityAuto-check passed

  • Kesekit Check

    cdppcorp/KESE-KIT

    Run a pre-deployment security compliance checklist based on KISA guidelines.

    361 GitHub stars~1.3k tokensUpdated 6 mo ago
    SecurityAuto-check passed

  • Setup

    hashgraph-online/hol-guard

    Install or initialize HOL Guard local runtime protection for Claude Code.

    815 GitHub stars~443 tokensUpdated today
    SecurityAuto-check passed

  • Clawscan CLI

    openclaw/clawscan

    A skill your agent uses when running or explaining the ClawScan CLI, including one-off agent-skill scans, benchmark runs, scanner fixtures, judge harness commands, env var validation, and…

    142 GitHub stars~3k tokensUpdated yesterday
    SecurityAuto-check passed

More from guardana/guardana

All 16 skills in this repo

  • Content Model

    guardana/guardana

    Route wording work to GPT (codex CLI) or Gemini (agy CLI) instead of writing it with Claude — landing-page copy, a readability rewrite of a README or docs page, attack and judge prompts for a rule…

    129 GitHub stars~1.2k tokensUpdated yesterday
    Auto-check passed

  • Ship

    guardana/guardana

    Commit and push a finished change the way this repo requires — explicit paths, one commit per logical change, no attribution, the five documentation places answered, the site checks before a push (a…

    129 GitHub stars~836 tokensUpdated yesterday
    Auto-check: notes

  • Add A Rule

    guardana/guardana

    Add security coverage to Guardana the way this repository requires — as a rule, evaluator or target, never by patching the engine — with the fixtures, the framework mapping and the documentation…

    129 GitHub stars~1.1k tokensUpdated yesterday
    Auto-check passed

  • Auto

    guardana/guardana

    Autonomous, non-interactive run of the whole lifecycle for one development task — size, plan, build, gate, review, fix, commit — without stopping for questions.

    129 GitHub stars~792 tokensUpdated yesterday
    Auto-check passed

  • Docs

    guardana/guardana

    Documentation work in this repo — the five places a user-visible change must answer, the page conventions the site build enforces, the tests that pin prose to the registry, and a simplification pass…

    129 GitHub stars~1k tokensUpdated yesterday
    Auto-check passed

  • False Green Audit

    guardana/guardana

    Hunt for the failure this project exists to prevent — code that compiles, types, tests green, and quietly reports "all clear" about something it never examined.

    129 GitHub stars~1.1k tokensUpdated yesterday
    Auto-check passed

Categories

Questions about Release

What does Release do?

Cut a Guardana release without repeating the mistakes previous releases made — a tag pushed before CI was green, a stale cache that hid a red build, a manual doc step nobody remembered, a script…. Release is an agent skill from guardana/guardana. Cut a Guardana release without repeating the mistakes previous releases made — a tag pushed before CI was green, a stale cache that hid a red build, a manual doc step nobody remembered, a script that runs the whole gate when asked for --help.

When should I use Release?

Release fits situations like: asked to release; tasks that involve Failing and flaky tests; tasks that involve Prompt injection and agent security.

How do I install Release in Claude Code?

Run `npx skills add guardana/guardana --skill release -a claude-code`. Or copy the skill folder (.claude/skills/release in guardana/guardana) into .claude/skills/release in your project. Claude Code loads it when a task matches its description.

How do I install Release in Codex?

Run `npx skills add guardana/guardana --skill release -a codex`. Or copy the skill folder (.claude/skills/release in guardana/guardana) into .agents/skills/release in your project. Codex loads it when a task matches its description.

Can I use Release in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add guardana/guardana --skill release -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/release, .gemini/skills/release, .github/skills/release and .opencode/skills/release in your project.

What does Release need to run?

Going by SKILL.md and its folder, Release needs the command-line tools its instructions call (gh and docker). Our summary lists: Docker.

Does Release access the network?

SKILL.md contains no URLs. Its commands use gh and docker, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Release safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Release use?

Release is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Release use?

About 921 tokens (SKILL.md is roughly 3.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Release?

Skills that share tags, products or a category with Release: Skill Scanner (getsentry/skills, 1k stars), Forensify (alexgreensh/repo-forensics, 188 stars), Hol Guard (hashgraph-online/hol-guard, 815 stars) and Kesekit Check (cdppcorp/KESE-KIT, 361 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Release?

guardana (a GitHub organization) maintains it in guardana/guardana, which has 129 GitHub stars. The repository holds 16 skills in this directory. The repository was last updated on October 7, 2026.

Source: guardana/guardana on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.