How do I install the Hoist skill?

Run npx skillmds@latest add slamb2k/hoist in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Hoist safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Hoist?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Hoist free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

slamb2k (@slamb2k) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Hoist by slamb2k — Agent Skill

Name: Hoist
Rating: 4.5 (4 reviews)
Author: slamb2k

Hoist

Generate secure, low-infrastructure release pipelines that publish artifacts directly — language packages (npm, PyPI, crates, RubyGems, NuGet, Go), GitHub Releases with binaries, static sites/Pages, or serverless functions — without building a container image. OIDC/trusted publishing, provenance, idempotent publish guards, and three trigger models (auto-bump with optional approval, tag, manual). The non-container sibling of /dock. Use when releasing a package or app that doesn't ship as a container.

slamb2k df6fb9d 6 files · 15.6 KB Updated Sep 10, 2026

File contents

Hoist - Non-Container Release Pipelines

When this skill is invoked, IMMEDIATELY output the banner below before doing anything else. Pick ONE tagline at random — vary your choice each time. CRITICAL: Reproduce the banner EXACTLY character-for-character, including the diagonal / glyph before the name.

{tagline}

       /$$ /$$   /$$  /$$$$$$  /$$$$$$  /$$$$$$  /$$$$$$$$
      /$$/| $$  | $$ /$$__  $$|_  $$_/ /$$__  $$|__  $$__/
     /$$/ | $$  | $$| $$  \ $$  | $$  | $$  \__/   | $$   
    /$$/  | $$$$$$$$| $$  | $$  | $$  |  $$$$$$    | $$   
   /$$/   | $$__  $$| $$  | $$  | $$   \____  $$   | $$   
  /$$/    | $$  | $$| $$  | $$  | $$   /$$  \ $$   | $$   
 /$$/     | $$  | $$|  $$$$$$/ /$$$$$$|  $$$$$$/   | $$   
|__/      |__/  |__/ \______/ |______/ \______/    |__/

Taglines:

📦 Up and away — published!
🏗️ Hoisting your release skyward!
🚀 From main to registry in one pull!
🪝 Latched on, lifting off!
⬆️ Straight to the top shelf!
🎁 Wrapped, signed, and shipped!
🛎️ Release, served fresh!
🔖 Tag it and bag it!

Flags

--skip-interview: detected + platform-aware defaults
--dry-run: show generated files without writing
--registry <name>: force the target registry

Output Formatting

(Input box, Pre-flight table, stage headers, status icons — copy the conventions from skills/dock/SKILL.md.)

Pre-flight

6-column dependency table: git (required, stop), gh (optional for GitHub release ops), sync (optional skill, fallback git pull), node/language toolchain (optional, detected). Follow the resolution-strategy list format used by other skills.

Platform Detection

Detect github vs azdo from the remote URL (same block as skills/dock/SKILL.md).

Phase 0: Sync

Invoke /sync (fallback git pull).

Phase 1: Detection

Explore subagent using references/interview-guide.md#detection-prompt → DETECTION_REPORT.

Phase 2: Interview

Follow references/interview-guide.md#interview-questions. Compile HOIST_CONFIG (target, registry/host, trigger model, approval gate, signing).

Phase 3: Generate

Read references/release-templates.md and references/hardening.md. Emit the CI workflow for the detected target + chosen trigger (secure by default: id-token, provenance, idempotent publish guard, concurrency; token exceptions per hardening.md). For binaries, add SHA256SUMS + optional signing. Generate deploy/SETUP.md from references/setup-guides.md.

Phase 4: Verify

Validate workflow YAML. Confirm the generated workflow carries the required hardening for its target (OIDC/id-token: write or a flagged token secret; provenance where supported; the version-exists guard; publish-before-tag). --dry-run previews without writing.

Final Report

Box report with target, trigger model, generated files, and a 🔐 Required setup section pointing at deploy/SETUP.md.

After presenting the report, record lifecycle completion and surface the next step:

_R="${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/plugins/marketplaces/slamb2k}"
node "$_R/hooks/session-guard.cjs" lifecycle-complete hoist

If the command prints a LIFECYCLE_OFFER_BEGIN…END block, present that offer to the user via AskUserQuestion as instructed inside the block. If it prints nothing (or LIFECYCLE_OFFER_NONE), do not mention the lifecycle engine.

Integration

Complements /dock (containers) — pick whichever fits. Runs after /rig; /ship's merge can trigger the generated auto-bump release. Only the serverless target may reference /keel for cloud identity.

---name: hoistdescription: Generate secure, low-infrastructure release pipelines that publish artifacts directly — language packages (npm, PyPI, crates, RubyGems, NuGet, Go), GitHub Releases with binaries, static sites/Pages, or serverless functions — without building a container image. OIDC/trusted publishing, provenance, idempotent publish guards, and three trigger models (auto-bump with optional approval, tag, manual). The non-container sibling of /dock. Use when releasing a package or app that doesn't ship as a container.---# Hoist - Non-Container Release PipelinesWhen this skill is invoked, IMMEDIATELY output the banner below before doing anything else.Pick ONE tagline at random — vary your choice each time.CRITICAL: Reproduce the banner EXACTLY character-for-character, including the diagonal `/` glyph before the name.```{tagline} /$$ /$$ /$$ /$$$$$$ /$$$$$$ /$$$$$$ /$$$$$$$$ /$$/| $$ | $$ /$$__ $$|_ $$_/ /$$__ $$|__ $$__/ /$$/ | $$ | $$| $$ \ $$ | $$ | $$ \__/ | $$ /$$/ | $$$$$$$$| $$ | $$ | $$ | $$$$$$ | $$ /$$/ | $$__ $$| $$ | $$ | $$ \____ $$ | $$ /$$/ | $$ | $$| $$ | $$ | $$ /$$ \ $$ | $$ /$$/ | $$ | $$| $$$$$$/ /$$$$$$| $$$$$$/ | $$ |__/ |__/ |__/ \______/ |______/ \______/ |__/ ```Taglines:- 📦 Up and away — published!- 🏗️ Hoisting your release skyward!- 🚀 From main to registry in one pull!- 🪝 Latched on, lifting off!- ⬆️ Straight to the top shelf!- 🎁 Wrapped, signed, and shipped!- 🛎️ Release, served fresh!- 🔖 Tag it and bag it!## Flags- `--skip-interview`: detected + platform-aware defaults- `--dry-run`: show generated files without writing- `--registry <name>`: force the target registry## Output Formatting(Input box, Pre-flight table, stage headers, status icons — copy the conventionsfrom skills/dock/SKILL.md.)## Pre-flight6-column dependency table: git (required, stop), gh (optional for GitHub releaseops), sync (optional skill, fallback git pull), node/language toolchain (optional,detected). Follow the resolution-strategy list format used by other skills.## Platform DetectionDetect github vs azdo from the remote URL (same block as skills/dock/SKILL.md).## Phase 0: SyncInvoke /sync (fallback git pull).## Phase 1: DetectionExplore subagent using references/interview-guide.md#detection-prompt → DETECTION_REPORT.## Phase 2: InterviewFollow references/interview-guide.md#interview-questions. Compile HOIST_CONFIG(target, registry/host, trigger model, approval gate, signing).## Phase 3: GenerateRead references/release-templates.md and references/hardening.md. Emit the CIworkflow for the detected target + chosen trigger (secure by default: id-token,provenance, idempotent publish guard, concurrency; token exceptions perhardening.md). For binaries, add SHA256SUMS + optional signing. Generatedeploy/SETUP.md from references/setup-guides.md.## Phase 4: VerifyValidate workflow YAML. Confirm the generated workflow carries the requiredhardening for its target (OIDC/`id-token: write` or a flagged token secret;provenance where supported; the version-exists guard; publish-before-tag).--dry-run previews without writing.## Final ReportBox report with target, trigger model, generated files, and a 🔐 Required setupsection pointing at deploy/SETUP.md.After presenting the report, record lifecycle completion and surface the next step:```bash_R="${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/plugins/marketplaces/slamb2k}"node "$_R/hooks/session-guard.cjs" lifecycle-complete hoist```If the command prints a `LIFECYCLE_OFFER_BEGIN…END` block, present that offer tothe user via AskUserQuestion as instructed inside the block. If it prints nothing(or `LIFECYCLE_OFFER_NONE`), do not mention the lifecycle engine.## IntegrationComplements /dock (containers) — pick whichever fits. Runs after /rig; /ship'smerge can trigger the generated auto-bump release. Only the serverless target mayreference /keel for cloud identity.

Frequently asked questions