Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add backspace-shmackspace/claude-devkit --skill shipgit clone --depth 1 https://github.com/backspace-shmackspace/claude-devkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/backspace-shmackspace/claude-devkit/ship)<a href="https://agentmods.dev/skills/backspace-shmackspace/claude-devkit/ship"><img src="https://agentmods.dev/badge/skills/backspace-shmackspace/claude-devkit/ship/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/backspace-shmackspace/claude-devkit/ship"><img src="https://agentmods.dev/badge/skills/backspace-shmackspace/claude-devkit/ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00016 | $0.19127 |
| Opus 5.5 | $0.00006 | $0.07651 |
| Sonnet 5.5 | $0.00003 | $0.03825 |
| Haiku 4.5 | $0.00002 | $0.01913 |
Grade D, and why
ship scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 600 "$KEY_FILE" Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
SECRETS_SCAN_DEPLOYED=$(ls ~/.claude/skills/secrets-scan/SKILL.md 2>/dev/null && echo "yes" || echo "no") Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
echo " rm -rf /tmp/ship-*" How it starts
The opening of the file, as written. The whole thing — 1,719 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/ship Workflow
Inputs
- Plan file: $ARGUMENTS # Full path, or bare plan name (e.g. "cross-repo-plan-support")
Output Rules
- Always print full absolute paths for all artifact references (plan files, review files, audit logs). This makes paths clickable in terminals like Warp. Use the resolved
$PLANS_DIRvalue, never relative paths.
Role
You are the work coordinator. You dispatch work to agents and check their results. You do NOT write code, explore the codebase, or run tests yourself — agents do that. Your job: read the plan once, dispatch each step, check verdicts, gate progression.
Step 0 — Pre-flight checks
Tool: Bash (git status, cleanup), Glob (agent checks) — Run all checks in parallel in a single message
Resolve devkit paths (MUST be first action in Step 0):
Tool: Bash
# --- Devkit Path Resolution ---
DEVKIT_SCRIPTS="${CLAUDE_DEVKIT:-$HOME/.claude-devkit}/scripts"
# Source path resolution helper
if [ -f "$DEVKIT_SCRIPTS/resolve-project-dir.sh" ]; then
. "$DEVKIT_SCRIPTS/resolve-project-dir.sh"
DEVKIT_PROJECT_DIR_RESOLVED=$(resolve_devkit_project_dir) || {
echo "Failed to resolve project directory" >&2; exit 1
}
elif [ -n "${DEVKIT_PROJECT_DIR:-}" ]; then
DEVKIT_PROJECT_DIR_RESOLVED="$DEVKIT_PROJECT_DIR"
else
echo "WARNING: devkit is not installed. Using deprecated .devkit/ fallback." >&2
DEVKIT_PROJECT_DIR_RESOLVED=".devkit"
fi
PLANS_DIR="$DEVKIT_PROJECT_DIR_RESOLVED/plans"
mkdir -p "$PLANS_DIR"
echo "Plans directory: $PLANS_DIR"
Resolve plan path (MUST be second action in Step 0):
If $ARGUMENTS (after removing any flags like --security-override) does not contain a / character,
treat it as a bare plan name and resolve it to $PLANS_DIR/<name>.md. If the name already ends with
.md, do not append it again. Verify the resolved file exists; if not, try without .md suffix removed
(in case the user passed e.g. feature.md). If neither exists, halt with:
"Plan not found: tried $PLANS_DIR/.md"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 1,719 lines · 16 tokens per session scan D f8d7974d2d1b
ship is a skill published in the GitHub repository backspace-shmackspace/claude-devkit (15 stars, last pushed 2mo ago), licensed MIT. It adds 16 tokens to every session and 19,127 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, enumerates other installed skills, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
delegation-detail
Use before writing any Agent brief or deciding whether to delegate, split or fan out work - brief shape (files to read first, what you left alone), when delegating pays, unit cap, parallel launch, liveness of a running delegate, impl loop and review/browser gates before a commit.
issue-driven-workflow
Turn a large task into a persistent plan file and a trackable Issue CSV (local files, not an external issue tracker), then execute the issues autonomously with per-row status updates. Use when work must survive across sessions or hand off between agents, when you need an auditable record of multi-step execution, or to…
strategic-alignment
Cascades strategy from boardroom to individual contributor. Detects and fixes misalignment between company goals and team execution. Covers strategy articulation, cascade mapping, orphan goal detection, silo identification, communication gap analysis, and realignment protocols. Use when teams are pulling in different…
feature-prioritisation
Aplica marcos de priorización (RICE, MoSCoW, Kano, ICE, Opportunity Scoring) para clasificar características e items del backlog. Úsalo cuando se te pida priorizar características, clasificar un backlog, decidir qué construir a continuación, o evaluar compensaciones entre ideas competidoras. Produce una lista de…
design-handoff-brief
Transform feature briefs into structured design briefs that give designers the context they need before opening Figma. Use when asked to write a design brief, create a design handoff, brief a designer on a new feature, or translate a PRD into design requirements. Produces a brief with user goal, emotional context…
stakeholder-communication
Communicate effectively with stakeholders across functions and seniority levels. Use this skill when writing status updates, preparing executive reviews, sharing technical decisions with non-technical audiences, managing up, communicating bad news, or designing the communication cadence for a project. Triggers on…