Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bostonaholic/team/shipitnpx skills add bostonaholic/team --skill shipitgit clone --depth 1 https://github.com/bostonaholic/teamWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bostonaholic/team/shipit)<a href="https://agentmods.dev/skills/bostonaholic/team/shipit"><img src="https://agentmods.dev/badge/skills/bostonaholic/team/shipit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.00608 |
| Opus 5 | $0.00023 | $0.00304 |
| Sonnet 5 | $0.00009 | $0.00122 |
| Haiku 4.5 | $0.00005 | $0.00061 |
Grade A, and why
shipit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
shipit — land a reviewed PR
shipit lands a pull request that already passed review. It pushes any unpushed
local commits, waits for CI to go green, and squash-merges. The PR title then
lands as the commit subject on the base branch. If a project puts a version in
the title, that version shows up in git log. It
finalizes an existing open PR, and never opens one. It is generic, and it
does no versioning, changelog editing, or release work. If a project assigns a
version at land time, that happens in a separate project-specific step before
/shipit (in this repo, the dev version-bump skill — see
docs/versioning.md). shipit only cares that the
branch is ready to land.
gh pr merge is irreversible, so two things guard it — neither of them a
frontmatter flag, and neither of them a question put to the user mid-run:
- Explicit ship intent. The skill fires only on a direct "ship it" / "land
the PR" /
/shipit. An approved, green, or finished-looking PR is not ship intent — the user decides when to land. - CI green (step 3), which gates the merge mechanically — a red or timed
out check stops the land before
gh pr mergeever runs.
The first guard is principle-explicit-intent applied to
the merge: an irreversible act fires on stated intent, never on state, and
granted authorization is spent, not re-asked.
Do not ask the user to confirm the merge. Ship intent already carried the
authorization to merge, so a confirmation re-requests permission the invocation
granted, and every caller that chains into /shipit inherits the stop. Once
step 3 reports green, merge. The guard against merging the wrong thing is
refusing to start without ship intent, not stopping halfway through a land the
user asked for.
Ticket completion comes from the PR body's Closes #<n> link; this skill performs no board mutation.
Procedure references
Read each reference completely when reaching that stage. Follow them in order; later stages depend on state and gates established earlier.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -204 lines · -111 tokens per session 8b98cdf4884c
- yesterday Changed · +54 lines 09aff62748c3
- 5d ago First seen · 203 lines · 156 tokens per session scan A f88efe4d1d4a
shipit is a skill published in the GitHub repository bostonaholic/team (11 stars, last pushed today), licensed MIT. It adds 45 tokens to every session and 608 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
tutti-app-release
Set up, review, run, or debug external repositories that publish a Tutti workspace app through the reusable Tutti App Release GitHub Actions workflow. Use for caller workflows, tutti.app.json manifests, @tutti-os/app-release-tools, S3/CloudFront release hosting, latest.json, versions.json, catalog.json, catalog-only…
analyze-performance-traces
Analyze Chrome, Chromium, Electron, React DevTools, or Perfetto-compatible JSON traces and audit user-reported profiling findings without loading large artifacts into context; prove trigger-to-render/layout chains, separate measured facts from source inference, find exact code choke points, classify forced layout and…
tutti-test-audit
Audit, design, write, materially revise, or remove Tutti tests. Use whenever Codex changes or reviews unit, component, conformance, integration, regression, platform, or repository tests; enforce a protected product contract, credible failure, correct owning boundary, negative-control evidence, overlap review…
tutti-agent-workspace-app
Build or evolve a complex agent-enabled Tutti workspace app repository. Use for Tutti apps with web/server/shared monorepos, @tutti-os/agent-acp-kit local agent runtimes, kit-owned TUTTICLI agent/composer discovery, dynamic agent catalogs, run-scoped MCP tool gateways, app-owned package builders, web-first debugging…
assimilate-popular-workflows
This skill should be used when the user asks to "find skills in the wild", "assimilate popular workflows", "discover SKILL.md files in repos", "research external skills", "find workflow patterns", "survey the skill landscape", "what skills exist out there", or wants to investigate public repositories for extractable…
process-builder
Scaffold new babysitter process definitions following SDK patterns, proper structure, and best practices. Guides the 3-phase workflow from research to implementation.