Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/dmytri/shipshapeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/dmytri/shipshape/doctor)<a href="https://agentmods.dev/commands/dmytri/shipshape/doctor"><img src="https://agentmods.dev/badge/commands/dmytri/shipshape/doctor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/dmytri/shipshape/doctor"><img src="https://agentmods.dev/badge/commands/dmytri/shipshape/doctor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00020 | $0.00672 |
| Opus 5.5 | $0.00008 | $0.00269 |
| Sonnet 5.5 | $0.00004 | $0.00134 |
| Haiku 4.5 | $0.00002 | $0.00067 |
Grade A, and why
doctor scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s https://raw.githubusercontent.com/dmytri/shipshape/main/skills/captain/SKILL.md | sha256sum What it actually says
Shipshape doctor
This command audits the Shipshape installation itself. It applies the current-design rule to the harness: no stale copies, no drift, no shadowed doctrine. It adds no doctrine.
Evidence rule: run each check and show the command output. Report what the output shows, never an unverified assurance. Change nothing without approval.
Portability rule: the checks are the contract; the example commands are examples. Use the host platform's equivalents for paths, hashing, and shell syntax, and the current runtime's own layout for skill and plugin directories.
-
Inventory. Locate every installed copy of the Shipshape skills, across generic and runtime-specific layouts:
- generic agent directories, project and global, such as
.agents/skills/and~/.agents/skills/; - runtime-specific skill directories, project and global, in each runtime's own skill layout;
- the runtime's plugin root, where the plugin channel installs
shipshapewith skills, agents, and hooks. Record location, channel, and scope for each copy. The channels are skills and plugin. The scopes are project and global. Symlinked copies resolve to their targets; record both the link and the target.
- generic agent directories, project and global, such as
-
Completeness. A skills-channel copy carries all six skills:
shipshape,captain,qm,crew,boatswain,shipwright, and the shipwright skill'stemplates.md. A plugin-channel copy also carriesagents/,hooks/,commands/, andrules/, and everyhooks/scripts/*.shis executable. Flag partial copies and lost execute bits. -
Freshness. Compare each installed
SKILL.mdagainst upstreammainby content hash, for example:curl -s https://raw.githubusercontent.com/dmytri/shipshape/main/skills/captain/SKILL.md | sha256sum sha256sum <installed path>/captain/SKILL.mdUse the host platform's hash tool:
sha256sumon Linux,shasum -a 256on macOS,Get-FileHashon Windows. A direct file diff against the fetched upstream copy is an equal substitute. The skills channel carries no version numbers; content comparison is the check. For a plugin-channel copy, also compare theversionin.plugin/plugin.jsonagainst upstream. Flag every stale copy. -
Coherence. Flag duplicate installs across scopes and channels. Name which copy the runtime resolves first and which copies it shadows. Multiple copies at different vintages mean an agent can invoke stale doctrine with full confidence; recommend collapsing to one channel.
-
Report and remedies. Present a table: location, channel, scope, completeness, freshness. Recommend the fix for each finding:
npx skills updatefor stale skills-channel copies,npx plugins add dmytri/shipshapeto refresh the plugin channel, and removal of redundant channels. Apply a remedy only when the user approves it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 30 lines · 20 tokens per session scan A c3d6b686c93f
doctor is a command published in the GitHub repository dmytri/shipshape (7 stars, last pushed 2mo ago), licensed 0BSD. It adds 20 tokens to every session and 672 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
ng-report-defect
Portable command prompt generated from skills/reporting-shared-defects/SKILL.md. Edit the skill, then run python tools/ng.py gen-commands; do not edit this file by hand.
ng-incident
Portable command prompt generated from skills/responding-to-incidents/SKILL.md. Edit the skill, then run python tools/ng.py gen-commands; do not edit this file by hand.
triage-failed-scenarios
Run the Playwright specs and triage each failing scenario — delete, update and re-record, or report as a defect.
harness-review
Review the current change set from an opposing harness-engineering perspective.
fix
Universal debugging and fix application with semantic code analysis.
bug-fixing-agent
Act as a senior developer expert with experience in OWASP, threat modeling, cloud security, secure engineering, and production risk assessment. Your goal is to fix the described malfunction without adding unnecessary complexity.