Install
$ agentstack add skill-max4c-skills-release-plugin Open-source listing, not yet scanned by AgentStack. Follow the source repository for install instructions.
Security review
⚠ Flagged1 finding(s); flagged for manual review. · v0.1.0 How review works →
- • Prompt-injection patterns
- • Secret / credential exfiltration
- • Dangerous shell & filesystem operations
- • Untrusted network calls
- • Known-malicious package signatures
- high Destructive filesystem operation.
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Release Plugin
Ship a Claude Code plugin update cleanly. The workflow is five steps (edit, bump, commit, push, update) but has sharp edges — the version-bump step is the silent failure mode, and repos with uncommitted WIP need a worktree to avoid disturbing your working state. This skill encodes the discipline.
Contract
Input: the current state of the plugin source on disk (you've already edited the skill files). Optionally a starting directory.
Output: committed and pushed changes, with the plugin's version bumped and the CHANGELOG updated. Plus a printed pair of commands for the user to run in Claude Code's UI.
What this skill does NOT do:
- Run
/plugin updateor/reload-plugins— these are Claude Code UI commands, not shell-reachable. You print them for the user. - Write your skill content for you — this skill ships what's on disk, it doesn't author changes.
- Decide whether your changes are good — it just ships them. Run
max:verify-before-donebeforehand if the changes are load-bearing.
Phases
Phase 1: Detect the plugin
Find the plugin.json that governs the changes being shipped.
- Start from the current working directory. If cwd is inside a
.claude-plugin/sibling directory or inside askills//directory, walk up until you find.claude-plugin/plugin.json. - Read that plugin.json and note:
name— the plugin's canonical name (e.g.,max,bugbook)version— current version (e.g.,0.3.0)repository— the git remote URL
- Check for a sibling
.claude-plugin/marketplace.jsonin the same repo (may be at repo root). Note itsnamefield — this is the marketplace suffix used in/plugin installand/plugin updatecommands. - If the plugin lives inside a subdirectory of a larger repo (e.g.,
plugins/bugbook/inside the Bugbook app repo), record that subdirectory path — you'll need it for surgical staging later.
If any of these can't be resolved, stop and ask the user to clarify which plugin they're updating.
Phase 2: Verify there are changes to ship
Run git status in the repo root. Look for modified or new files under the plugin's path.
- If nothing has changed: tell the user there's nothing to ship and exit.
- If only
plugin.jsonhas changed: that's a version-bump-only commit, which is unusual — ask the user what content change they meant to include. - If substantive changes exist: proceed.
Critical check: if the repo also has unrelated modified files (a working tree mixed with WIP), note them now. You'll need to avoid staging them in Phase 6.
Phase 3: Determine the version bump
Look at the git diff of the changes being shipped (git diff if the plugin is in a subdirectory, git diff otherwise) and recommend a version bump based on this rubric:
| Bump type | When to use | Examples | |---|---|---| | Patch (0.x.y → 0.x.y+1) | Description tweaks, typo fixes, README corrections, frontmatter polish, CHANGELOG updates, minor clarifications | "Fix install command in README", "Improve grill-me description pushiness" | | Minor (0.x.y → 0.(x+1).0) | New skills, new phases in existing skills, new behaviors, new bundled resources, new composition links | "Add release-plugin skill", "Add ambiguity report persistence to grill-me" | | Major (0.x.y → 1.0.0) | Breaking changes to how skills are invoked, removed skills, renamed skills, changed composition contracts | "Rename write-prd to draft-prd", "Remove tech-spec grill gate requirement" |
Present the recommended bump to the user with 1-2 sentences of reasoning. Let them override.
Phase 4: Update plugin.json and CHANGELOG
Update plugin.json:
{
"version": ""
}
Update CHANGELOG.md if it exists. Add a new section at the top in the same style as the previous entries:
## v —
###
- **** —
If there's no CHANGELOG, skip this step silently — not every plugin has one.
Phase 5: Draft the commit message
Read the git diff and compose a commit message:
- First line: imperative summary under 72 chars (e.g., "Add release-plugin skill")
- Blank line
- Body: 2-5 bullet points or a short paragraph explaining what changed and why. Mention the version bump.
Present the draft to the user and let them edit. If they approve, proceed.
Phase 6: Stage surgically and commit
Change directory to the repo root. Then:
If the repo has no WIP (only the plugin changes are modified):
git add -A
If the repo has WIP unrelated to the plugin (the critical case — this is what the bugbook plugin hits because the Bugbook app repo has ongoing Swift work):
git add
# e.g., git add .claude-plugin plugins/bugbook
Never use git add -A or git add . when WIP is present. You'll sweep up the user's in-progress work and commit it accidentally.
Then:
git commit -m ""
Phase 7: Push to the right branch
Determine which branch to push to:
- Check
git symbolic-ref refs/remotes/origin/HEADfor the remote's default branch (usuallymain). - Check the current branch with
git branch --show-current. - If current branch is the default branch: push directly.
- If current branch is a feature branch (e.g.,
devin the Bugbook case): push the feature branch first, then merge to default via worktree (Phase 8).
git push origin
Phase 8: (Conditional) Merge to default branch via worktree
Only run this phase if the current branch is NOT the default branch (i.e., you pushed to dev and need to get to main).
The point of using a worktree is to avoid disturbing the user's WIP by switching branches in the main working tree.
# Create a temporary worktree for the merge
git worktree add /tmp/plugin-release-merge
# Move into it and merge
cd /tmp/plugin-release-merge
git pull origin --ff-only
git merge --no-edit
git push origin
# Clean up
cd
git worktree remove /tmp/plugin-release-merge --force
git worktree prune
If the merge produces conflicts (rare for plugin-only changes, since plugins don't usually collide with app code), stop and hand off to the user.
Phase 9: Print the follow-up commands
Print the exact commands the user needs to type in Claude Code's UI:
/plugin update @
/reload-plugins
Where:
- `
is thenamefield from the plugin'splugin.json` - `
is thenamefield from the marketplace'smarketplace.json`
Example for the max plugin:
/plugin update max@max4c-skills
/reload-plugins
Example for the bugbook plugin:
/plugin update bugbook@max4c-bugbook
/reload-plugins
Explicitly tell the user: "These are Claude Code UI commands — you need to type them yourself, I can't run them for you."
Phase 10: (Optional) Cache cleanup
Offer to clean up old cached versions of the plugin that are no longer needed:
ls ~/.claude/plugins/cache///
For each directory that isn't the new version, offer to delete it:
rm -rf ~/.claude/plugins/cache///
Only delete after the user confirms the new version loaded correctly — deleting prematurely could strand the user if the new version has a bug and they need to roll back.
Red flags
- "I'll bump the version later." No. The version bump is what makes the update land. Forgetting it means your changes sit unused and
/plugin updatereports "already at latest". This is the most common failure mode and the main reason this skill exists. - "Let me just
git add -Areal quick." Not in a repo with WIP. Stage specific paths. - "I already pushed, let me skip the version bump." You need to amend or make a new commit that bumps the version. A push without a bump is effectively a no-op from the plugin-updater's perspective.
- "The commit message can be
update skill." No. Future-you will want to know what changed without reading the diff. Write a real message.
Example invocation
User: "I just tuned the grill-me description, ship it"
Skill:
- Detects cwd is inside
~/Code/skills/skills/grill-me/→ plugin ismaxat~/Code/skills, marketplacemax4c-skills git statusshowsskills/grill-me/SKILL.mdmodified — has changes to ship- Reads the diff: it's a description edit (frontmatter only). Recommends patch bump (0.3.0 → 0.3.1)
- Updates
plugin.jsonversion to0.3.1and adds a CHANGELOG entry - Drafts commit message: "Tune grill-me description for better undertriggering coverage"
- User approves
git add -A(clean working tree),git commit,git push origin main- Current branch IS default branch, skip Phase 8
- Prints:
`` /plugin update max@max4c-skills /reload-plugins ``
- Offers to clean up
~/.claude/plugins/cache/max4c-skills/max/0.3.0/after user confirms the new version loaded
Total elapsed: ~30 seconds of work you didn't have to do yourself.
Composition
Pairs naturally with:
max:verify-before-done— run BEFORE release to confirm your skill changes actually do what you expect. Releasing a broken skill is worse than not releasing it.max:grill-me— run on the CHANGELOG entry if it feels hand-wavy. Ambiguous release notes mean you won't remember what changed when you look back.
Does NOT compose with:
max:write-prdormax:tech-spec— those are about authoring, this is about shipping. Different phase.
Further reading
- Claude Code plugin marketplace docs — the authoritative source on marketplace schema and install commands
- Anthropic's official plugin marketplace at
.claude/plugins/marketplaces/claude-plugins-official/.claude-plugin/marketplace.json— a real-world example of a multi-plugin marketplace with diverse source types
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: max4c
- Source: max4c/skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.