What is ship-safe-score?

A command-line check that gives a project a security score from 0 to 100 and a letter grade from A to F. It also shows deductions for exposed secrets, code vulnerabilities, and dependency problems.

Use it to check whether a project is safe to ship and review which security areas lowered its score. It can also help monitor the score with a pre-push Git hook, which checks changes before they are pushed.

It gives you a quick way to spot common security risks before releasing code. The grade makes the result easier to judge at a glance.

ship-safe-score — Skill for Claude Code by asamassekou10

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add asamassekou10/ship-safe --skill ship-safe-score

Clone the repo

git clone --depth 1 https://github.com/asamassekou10/ship-safe

Made for: Claude Code.

Or install ship-safe, the plugin that ships this one along with the rest of its 9 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/asamassekou10/ship-safe/ship-safe-score/github.svg)](https://agentmods.dev/skills/asamassekou10/ship-safe/ship-safe-score)

Your own site

<a href="https://agentmods.dev/skills/asamassekou10/ship-safe/ship-safe-score"><img src="https://agentmods.dev/badge/skills/asamassekou10/ship-safe/ship-safe-score/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/asamassekou10/ship-safe/ship-safe-score"><img src="https://agentmods.dev/badge/skills/asamassekou10/ship-safe/ship-safe-score.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 38 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 484 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 3 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium MCP Rug Pull · line 14
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 20
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 44
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00038	$0.00484
Opus 5	$0.00019	$0.00242
Sonnet 5	$0.00008	$0.00097
Haiku 4.5	$0.00004	$0.00048

Measured 12d ago against content hash a91cb9b94467, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

ship-safe-score scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

claude-code-plugin/skills/ship-safe-score/SKILL.md · 51 lines

What it actually says

Ship Safe — Security Score

You are checking this project's security health score.

Step 1: Run the score command

npx ship-safe@latest score $ARGUMENTS 2>&1

If $ARGUMENTS is empty, default to .:

npx ship-safe@latest score . 2>&1

If the user mentions skipping dependencies, add --no-deps.

The command outputs styled terminal text (not JSON). Parse the output for the score, grade, and category breakdown.

Step 2: Present the results

Extract and present:

Score and Grade: The 0-100 score and A-F letter grade
Category Breakdown: Show deductions per category (Secrets, Code Vulnerabilities, Dependencies)
Grade Meaning:
- A (90-100): Ship it! Your code looks secure.
- B (75-89): Minor issues to review, but generally safe.
- C (60-74): Fix issues before shipping to production.
- D (40-59): Significant security risks present.
- F (0-39): Not safe to ship. Critical issues found.

Step 3: Recommendations

Based on the score:

A or B (75+): Congratulate the user. Suggest running npx ship-safe guard to install a pre-push git hook that maintains the score. Mention they can run /ship-safe for a detailed breakdown anytime.
C (60-74): Recommend running /ship-safe for a full audit to see exactly what needs fixing. Mention the most likely problem areas based on the category breakdown.
D or F (below 60): Strongly recommend running /ship-safe immediately. Offer to start the full audit right now. Emphasize that critical findings should be fixed before any deployment.
For any score, mention /ship-safe-baseline to track progress over time and /ship-safe-fix for automated remediation.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago First seen · 51 lines · 38 tokens per session scan A a91cb9b94467

Subscribe to this mod's changes

ship-safe-score is a skill published in the GitHub repository asamassekou10/ship-safe (842 stars, last pushed 5d ago), licensed MIT. It adds 38 tokens to every session and 484 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Security cli npm owasp secrets security-tools

security-review

Security audit focused on OWASP Top 10 — injection, auth flaws, secrets exposure, IDOR, and more. Use when reviewing code for vulnerabilities, before deploying to production, or auditing a new codebase.

chandrudp29/skillhub · 46 tokens

security-audit

Audit code and infrastructure for security vulnerabilities. Use when performing security reviews, checking for OWASP Top 10 issues, auditing dependencies, or hardening applications.

asgarovf/locusai · 35 tokens

depsguard

Install and run DepsGuard, a zero-dependency CLI that scans and fixes package manager configs (npm, pnpm, yarn, bun, uv) for supply chain security best practices.

arnica/depsguard · 41 tokens

optimize-cc-md

Interactively helps users optimize their CLAUDE.md files. Use when user asks to "optimize my CLAUDE.md", "my CLAUDE.md is too long", "improve organization", or "split my CLAUDE.md". Runs validation, explains issues conversationally, and helps create @import files to reduce size and improve structure.

pdugan20/claudelint · 77 tokens

skillpm

Manage npm-distributed Agent Skill packages with skillpm.

sbroenne/skillpm · 14 tokens

validate-cc-md

Validates CLAUDE.md files for size, imports, and structure. Use when user asks to "check my CLAUDE.md", "why is my CLAUDE.md too long", "validate imports", or "fix CLAUDE.md errors". Checks file size limits (30KB warning, 50KB error), @import directives, frontmatter in .claude/rules/, and section organization.

pdugan20/claudelint · 88 tokens