Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/dmytri/shipshape/doctorgit clone --depth 1 https://github.com/dmytri/shipshapeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00020 | $0.00672 |
| Opus 5 | $0.00010 | $0.00336 |
| Sonnet 5 | $0.00004 | $0.00134 |
| Haiku 4.5 | $0.00002 | $0.00067 |
Grade A, and why
doctor scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s https://raw.githubusercontent.com/dmytri/shipshape/main/skills/captain/SKILL.md | sha256sum What it actually says
Shipshape doctor
This command audits the Shipshape installation itself. It applies the current-design rule to the harness: no stale copies, no drift, no shadowed doctrine. It adds no doctrine.
Evidence rule: run each check and show the command output. Report what the output shows, never an unverified assurance. Change nothing without approval.
Portability rule: the checks are the contract; the example commands are examples. Use the host platform's equivalents for paths, hashing, and shell syntax, and the current runtime's own layout for skill and plugin directories.
-
Inventory. Locate every installed copy of the Shipshape skills, across generic and runtime-specific layouts:
- generic agent directories, project and global, such as
.agents/skills/and~/.agents/skills/; - runtime-specific skill directories, project and global, in each runtime's own skill layout;
- the runtime's plugin root, where the plugin channel installs
shipshapewith skills, agents, and hooks. Record location, channel, and scope for each copy. The channels are skills and plugin. The scopes are project and global. Symlinked copies resolve to their targets; record both the link and the target.
- generic agent directories, project and global, such as
-
Completeness. A skills-channel copy carries all six skills:
shipshape,captain,qm,crew,boatswain,shipwright, and the shipwright skill'stemplates.md. A plugin-channel copy also carriesagents/,hooks/,commands/, andrules/, and everyhooks/scripts/*.shis executable. Flag partial copies and lost execute bits. -
Freshness. Compare each installed
SKILL.mdagainst upstreammainby content hash, for example:curl -s https://raw.githubusercontent.com/dmytri/shipshape/main/skills/captain/SKILL.md | sha256sum sha256sum <installed path>/captain/SKILL.mdUse the host platform's hash tool:
sha256sumon Linux,shasum -a 256on macOS,Get-FileHashon Windows. A direct file diff against the fetched upstream copy is an equal substitute. The skills channel carries no version numbers; content comparison is the check. For a plugin-channel copy, also compare theversionin.plugin/plugin.jsonagainst upstream. Flag every stale copy. -
Coherence. Flag duplicate installs across scopes and channels. Name which copy the runtime resolves first and which copies it shadows. Multiple copies at different vintages mean an agent can invoke stale doctrine with full confidence; recommend collapsing to one channel.
-
Report and remedies. Present a table: location, channel, scope, completeness, freshness. Recommend the fix for each finding:
npx skills updatefor stale skills-channel copies,npx plugins add dmytri/shipshapeto refresh the plugin channel, and removal of redundant channels. Apply a remedy only when the user approves it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 30 lines · 20 tokens per session scan A c3d6b686c93f
doctor is a command published in the GitHub repository dmytri/shipshape (7 stars, last pushed 28d ago), licensed 0BSD. It adds 20 tokens to every session and 672 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
coder-eval-implement-plan
Implement an approved codereval plan phase by phase with risk-scaled per-phase review, then a final code review.
kill-mutants
Analyze surviving mutants from a mutation testing run and write targeted unit tests to kill them. Re-runs mutations to confirm kills.
OPSX: Bulk Archive
Archive multiple completed changes at once.
mutate
Run mutation testing to verify test quality. Builds a custom mutation tool or uses an existing framework, runs mutations, and reports the mutation score with surviving mutants.
auto-run
PitWay: Manage auto-run authorization for automatic task continuation.
task-integrate
PitWay: Apply a dispatched task's worktree commit to the main tree.