Borrowing it
Nothing to install: this file belongs to 0xSoftBoi/suwappubot. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/0xSoftBoi/suwappubot/main/.claude/commands/ship.mdgit clone --depth 1 https://github.com/0xSoftBoi/suwappubotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/0xsoftboi/suwappubot/ship)<a href="https://agentmods.dev/commands/0xsoftboi/suwappubot/ship"><img src="https://agentmods.dev/badge/commands/0xsoftboi/suwappubot/ship.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.02285 |
| Opus 5 | $0.00022 | $0.01143 |
| Sonnet 5 | $0.00009 | $0.00457 |
| Haiku 4.5 | $0.00004 | $0.00229 |
Grade C, and why
ship scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -s https://python-api-production-8526.up.railway.app/health | python3 -m json.tool Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s https://python-api-production-8526.up.railway.app/health | python3 -m json.tool How it starts
The opening of the file, as written. The whole thing — 176 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ship Skill
Runs the full ship loop. Two rules that outrank everything below:
- Do NOT merge while CI is red.
- Shipping does not end at "merged." It ends when the deployed system is verified running the code you merged, and its logs are clean. Steps 6-8 are not optional epilogue — they are where every failure this repo has actually hit gets caught.
Optional arg: a PR title. If omitted, infer a concise conventional-commit title from the diff.
Why this skill is shaped like this
Every cheap gate proves something NARROWER than what we want to conclude:
| Gate | Reads as | Actually proves |
|---|---|---|
| Railway deploy SUCCESS | the code works | a container built and started |
| A green deploy with a loose install | deps are correct | drift is undetectable here |
| CI green on your branch | main is green | nothing about main |
| Service status SUCCESS | running current code | some build, of some commit, sometime |
/health 200 |
the bot booted | that host answered |
| No ImportError in logs | nothing is wrong | no ImportError |
So verify the specific thing, per service, and then read the logs. Never generalise one green signal into a claim about a different component.
Step 0 — Pre-flight (CLAUDE.md mandatory checklist)
REPO=$(git rev-parse --show-toplevel); cd "$REPO"
git rev-parse --abbrev-ref HEAD
git rev-parse --git-common-dir # a worktree? then NEVER rebase
ls .git/*.lock 2>/dev/null || echo "no locks"
git stash list | head
git status --short
git status --short | grep -iE "node_modules|\.next/|dist/" && echo "ARTIFACTS — gitignore first, stop" || true
git fetch origin main -q && git rev-list --left-right --count origin/main...HEAD
If on main, branch first — never commit straight to main.
Step 1 — Format, parse, and LOCKFILE check (CI gates on all three)
PYF=$(git status --short | awk '{print $2}' | grep '\.py$')
[ -n "$PYF" ] && python3 -c "import ast; [ast.parse(open(f).read()) for f in '''$PYF'''.split()]; print('parse ok')"
[ -n "$PYF" ] && black --line-length=100 $PYF
If you changed ANY package.json, you must regenerate its lockfile — CI runs
bun install --frozen-lockfile in showcase/, terminal/, webapp/, api-ts/
and mobile. A missing lockfile update fails CI even when every deploy is green.
Use the bun version CI pins (see .github/workflows/test.yml) — a lockfile
written by a different bun can fail the frozen check on its own:
BUN_PIN=$(grep -m1 'bun-version:' .github/workflows/test.yml | awk '{print $2}')
npm i --no-save bun@"$BUN_PIN" >/dev/null 2>&1
for d in showcase terminal webapp api-ts; do
[ -f "$d/bun.lock" ] || continue
(cd "$d" && ../node_modules/.bin/bun install --frozen-lockfile >/dev/null 2>&1) \
&& echo "$d lockfile OK" || echo "$d LOCKFILE DRIFT — run: (cd $d && bun install) and commit"
done
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 176 lines · 43 tokens per session scan C 339b57635d47
ship is a command published in the GitHub repository 0xSoftBoi/suwappubot (3 stars, last pushed today), licensed Apache-2.0. It adds 43 tokens to every session and 2,285 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
commit
Automatically generate commit message based on changes and push to current branch. Analyzes git diff to create meaningful commit following conventional commits format. Optionally creates and pushes a git tag.
commit
Smart conventional commit with security validation, branch flow enforcement, and auto-detection. Use for git commit, commit changes, save work, stage and commit.
changelog-auto
Auto-generar entradas de CHANGELOG.md desde commits convencionales. Usa cuando el usuario dice "generar changelog", "update changelog", "changelog", "conventional commits", "auto changelog", "release notes", "generar release notes", "伽 changelog". Genera entradas desde conventional commits (feat, fix, docs, etc.) con…
changelog
Gera changelogs a partir do histórico git e valida commits convencionais. Uso: /changelog [opções].
commit-push-pr
Commit, push, and open a PR (includes changeset creation).
ship
Encodes the "stage and commit" ritual: verify (receipt gate) → scope → branch → write the commit message from what is actually staged → commit → push → open PR to the default branch → move the Jira issue to In Review. NO merge (merging is the reviewer's call). NO tag (deploys are project-specific and out of scope).