Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/3awny/qship/qmigrationdevchecknpx skills add 3awny/qship --skill qmigrationdevcheckgit clone --depth 1 https://github.com/3awny/qshipWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00073 | $0.06491 |
| Opus 5 | $0.00036 | $0.03245 |
| Sonnet 5 | $0.00015 | $0.01298 |
| Haiku 4.5 | $0.00007 | $0.00649 |
Grade A, and why
qmigrationdevcheck scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 480 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Alembic Migration Chain Validator
You are validating that Alembic migrations on the current branch are compatible with develop — no multiple heads now, no multi-head after merge, no chain breaks, no {{COMPANY_SLUG}}-specific violations.
Multi-repo contract: This skill operates on the repos in
$SKILLS_ROOT/qship/repos.jsonwhosehas_migrationsflag istrue. Single-repo users with one alembic chain get a degenerate-but-correct check (one repo in the iteration). Multi-repo users get full cross-schema validation. Resolve the list at the start of every invocation:REPOS_WITH_MIGRATIONS=$(jq -r '.[] | select(.has_migrations==true) | .name' "$SKILLS_ROOT/qship/repos.json")
Input: $ARGUMENTS may contain:
- A specific repo name (must match one of the
has_migrations==trueentries) orall(default — every flagged repo) - A caller flag:
mode=qshipp2(report-only) ormode=user(apply fixes, default)
Examples:
/qmigrationdevcheck→ default user mode, all repos withhas_migrations==true, applies fixes interactively/qmigrationdevcheck <repo>→ user mode, just that repo (must be flagged for migrations)/qmigrationdevcheck mode=qshipp2 <repo>→ invoked by /qshipp2; REPORT ONLY, do not apply fixes
Mode Semantics — READ FIRST
The caller mode fundamentally changes behaviour:
| Mode | Detection | Fix application | Output |
|---|---|---|---|
user (default) |
Runs all checks | Applies fixes interactively — confirms before risky changes | Report + applied changes summary |
qshipp2 |
Runs all checks | NEVER applies fixes. Report-only. | Report structured for the caller to post as a PR comment |
In qshipp2 mode, skip Step 8 entirely. The orchestrator decides what to do with findings (post PR comment, block the pipeline, etc.).
In user mode, Step 8 is mandatory after any FAIL — detect-and-describe-without-fixing is not the point of the direct invocation.
Parse mode AND repo selector from $ARGUMENTS:
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 480 lines · 73 tokens per session scan A 476676084184
qmigrationdevcheck is a skill published in the GitHub repository 3awny/qship (2 stars, last pushed 2mo ago), licensed MIT. It adds 73 tokens to every session and 6,491 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
codex-autoresearch
Run autonomous, measurable experiments in a Git repository: change one hypothesis, verify a numeric metric, keep improvements, and revert failures. Use when the user wants Codex to keep iterating toward a numeric target in the foreground or as a detached background run. Do not use for ordinary one-shot coding…
map-wayfind
Decision-frontier wayfinding: build and work a durable map of open design decisions BEFORE planning, for large or foggy efforts where /map-plan would force premature decomposition. Use when a task is too big or too vague to decompose — many unknowns, tangled decisions, or "I'm not even sure what to build yet" — and…
map-fast
Minimal workflow for small, low-risk changes — no planning, no learning.
clipboard
Copy text to clipboard with optional rich formatting. Triggers on "copy to clipboard", "copy that", "pbcopy", "copy formatted", "copy rich text".
neo4j-modeling-skill
Design, review, and refactor Neo4j graph data models. Use when choosing node labels vs relationship types vs properties, migrating relational/document schemas to graph, detecting anti-patterns (generic labels, supernodes, missing constraints), designing intermediate nodes for n-ary relationships, enforcing schema with…
alphafold-database
Access AlphaFold 200M+ AI-predicted protein structures. Retrieve structures by UniProt ID, download PDB/mmCIF files, analyze confidence metrics (pLDDT, PAE), for drug discovery and structural biology.