Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add andreapollastri/larapilot --skill larapilot-shipgit clone --depth 1 https://github.com/andreapollastri/larapilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/andreapollastri/larapilot/larapilot-ship)<a href="https://agentmods.dev/skills/andreapollastri/larapilot/larapilot-ship"><img src="https://agentmods.dev/badge/skills/andreapollastri/larapilot/larapilot-ship/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/andreapollastri/larapilot/larapilot-ship"><img src="https://agentmods.dev/badge/skills/andreapollastri/larapilot/larapilot-ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.03063 |
| Opus 5.5 | $0.00014 | $0.01225 |
| Sonnet 5.5 | $0.00007 | $0.00613 |
| Haiku 4.5 | $0.00003 | $0.00306 |
Grade A, and why
larapilot-ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 131 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Larapilot — Ship & Deploy
Release accepted increments to production. Oliver runs red-team assessment (findings → Lars); Lars runs OWASP blue-team gate; Jack orchestrates deploy; Sarah owns deploy/CI shell scripts and server-side glue Jack's runbooks invoke; Emma, Lauren, and Emily verify public-site readiness; Sophia seeds post-launch support runbook.
Context
php artisan larapilot:context ship — with --session={token} when this conversation already holds one, --fresh after a compaction. Read every file under data.runtime.read, none under loaded. Settings, paths, data.project, and data.dev_docs come from that envelope: no config-show.
This skill keeps the phase sequence and the gates. The detail is in the files it reads, written once: Deploy Runbooks, Security Assessment, and Privacy & Legal Compliance (ship-2.md), Web Launch Checks (ship-3.md), Maintenance & Support and Red Team & Penetration Testing (ops-2.md), the Freshness gate (dev-docs.md — no shipped feature leaves without a current domain doc). On demand: Infrastructure & Cloud (ship-1.md) when the PRD leaves a platform choice open, ux-3.md for the SEO structure behind the launch checks.
When data.settings.release_mode is YES, Sarah runs php artisan larapilot:release-ship --semver=x.y.z (add --push only under GITFLOW_PUSH or when the user asked to push). Do not merge and tag by hand.
Output Economy
Structured terse. Between phases: PASS / FAIL / BLOCKED + one-line reason. OWASP and launch findings as bullets or tables. Final release report: structured fields only (platform, commit, health, compliance summary).
The Team
| Agent | Role |
|---|---|
| 🤖 Zoey | AI Guru — sharpens user intent, output economy, sub-agent orchestration, session/credit risk (every skill) |
| 🎯 Oliver | Ethical Hacker — red-team assessment & simulated attacks; reports findings to Lars |
| 🔐 Lars | Security Expert — OWASP-aligned pre-deploy assessment, GO/NO-GO verdict (incorporates Oliver's report) |
| 🚀 Jack | DevOps Engineer — deploy per PRD choice, edge/CDN/WAF, cloud, observability |
| ⌨️ Sarah | CLI / Git / Linux — deploy hooks, CI deploy jobs, release Git tagging/scripts, systemd/cron, SSH/rsync glue |
| 💰 Aurora | FinOps Expert — validates deploy target, infra/security budget; privileges security spend with Lars/Violet |
| ⚖️ Violet | Legal Expert — full privacy/legal launch gate: cookie/ToS, retention, anonymization, opt-out, subprocessors |
| 🌍 Emily | Translator — localized pages, currency/timezone correctness, per-market legal copy with Violet |
| 📈 Emma | SEO & Web Performance Specialist — URL structure, breadcrumbs, robots/sitemap/llms.txt, hreflang, Analytics, Lighthouse (public sites) |
| 💬 Lauren | Social Media Manager — marketing launch readiness, OG/share, campaign assets (public sites) |
| 📝 Albert | Tech Writer — release docs, OpenAPI finalization, PDF client manuals, migration guides |
| 🎧 Sophia | Support Manager — post-launch support runbook, bug-intake process, maintenance doc checklist |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed 623ac25ef7e6
- 20d ago Changed · -191 lines 5a9eac0f8c2f
- 21d ago Changed 018980d4f8e6
- 24d ago Changed · +2 lines 2920de1b82e7
- 28d ago Changed aacd5af10782
- 29d ago Changed · +2 lines · -67 tokens per session 3c3b581518a9
- 1mo ago Changed 4ee97bc4c05b
- 1mo ago Changed · +1 lines 5aba73c3614e
- 1mo ago Changed 7cfd41af2e60
- 1mo ago First seen · 317 lines · 101 tokens per session scan A 275a59950dc7
larapilot-ship is a skill published in the GitHub repository andreapollastri/larapilot (23 stars, last pushed 6d ago), licensed MIT. It adds 34 tokens to every session and 3,063 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deploy
Build a container image, push it, and deploy the service to the Akka platform. This is the transition from local development to development on the AAO platform.
slo-define
Define a service's reliability contract: SLIs, SLO target and window, error budget and exhaustion policy (spec-only). Activates when a service or critical flow has no SLO, or a target has no SLIs or error budget. Do not use without an observability stack to measure SLIs (use decision-interview), for one post-deploy…
akka-deploy
Alias for akka-sdd. Use for the Akka workflow corresponding to /akka:deploy.
architectural-design-principles
System-level engineering canon, the architecture counterpart to software-design-principles. Layered architecture + dependency direction, ports and adapters (repository / ORM-as-adapter), the twelve-factor app for cloud-native development, evolutionary architecture with fitness functions, and evolutionary database…
06-release
Ship the verified sprint: the release gate the spine protects, then a verified deploy. Release ≠ runnable — the slice is runnable from /04's handoff §(e) onward; this seat adds deploy + verification, not runnability. GATE FIRST: BLOCKs on a non-SHIP qa-report (unless the director ruled every High in §(h), dated), an…
alibaba-cloud
Provides comprehensive Alibaba Cloud (Aliyun) guidance including ECS, ApsaraDB, OSS, SLB, VPC, RAM, ACK (Kubernetes), Function Compute, API Gateway, CDN, and monitoring services. Covers infrastructure provisioning with Terraform/ROS, cloud architecture design, security best practices, cost optimization, and migration…