Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dinhanhthi/coding-friend/cf-shipnpx skills add dinhanhthi/coding-friend --skill cf-shipgit clone --depth 1 https://github.com/dinhanhthi/coding-friendWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dinhanhthi/coding-friend/cf-ship)<a href="https://agentmods.dev/skills/dinhanhthi/coding-friend/cf-ship"><img src="https://agentmods.dev/badge/skills/dinhanhthi/coding-friend/cf-ship.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.01057 |
| Opus 5 | $0.00027 | $0.00528 |
| Sonnet 5 | $0.00011 | $0.00211 |
| Haiku 4.5 | $0.00005 | $0.00106 |
Grade A, and why
cf-ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/cf-ship
CLI Requirement: NONE — Works without
coding-friend-cli. See CLI requirements for the full matrix.
Ship the current work. Hint: $ARGUMENTS
Workflow
Step 0: Custom Guide & Flags
Custom guide (auto-loaded at invocation — do NOT skip):
bash "<plugin-root>/lib/load-custom-guide.sh" cf-ship
If the block above produced any content, integrate the returned sections: ## Before → execute before Step 1, ## Rules → apply throughout, ## After → after the final step.
Guard — do NOT short-circuit: If a ## Before section was injected above, you MUST carry it out before ANY assessment of whether there is something to ship. A clean working tree or being on main does NOT by itself mean "nothing to ship" — a ## Before guide may still require action (e.g. a version-bump / tag / release flow). Never conclude "nothing to ship" until Step 0's ## Before has been executed.
Dry-run check: If $ARGUMENTS contains --dry-run, enter simulation mode — run all steps below but do not execute any destructive action (no commit, no push, no PR creation). Prefix each step's output with [dry-run] and show what would happen. At the end, print:
🏃 DRY RUN COMPLETE — nothing was pushed or created.
Step 1: Verify
Load the cf-verification skill and run the full checklist:
- Tests pass
- Build succeeds
- Linter clean
- No console errors
If ANY check fails, stop and fix before proceeding.
Capturing out-of-scope side-effects: If verification surfaces a problem unrelated to the work being shipped that is non-trivial (fixing it inline would block or expand this ship), do NOT fix it now. Record it for later, then continue the ship workflow:
bash "<plugin-root>/lib/capture-later.sh" \
--name "<short title>" --description "<what & where — enough to act on cold>" \
--source cf-ship [--slug <task/plan slug, if one exists>] [--problem "<what is being shipped>"]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 120 lines · 54 tokens per session scan A ab07044a3b7a
cf-ship is a skill published in the GitHub repository dinhanhthi/coding-friend (3 stars, last pushed yesterday), licensed MIT. It adds 54 tokens to every session and 1,057 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
openyida-cross-platform-release-guard
OpenYida 跨端发布风险守卫。当改动涉及浏览器/URL 拉起（openyida login、bridge 页面唤起、resolveBrowserLauncher、openBrowser、spawn 打开浏览器）、或在 macOS 上开发但需要发布给 Windows/Linux 用户、或准备打 tag 发布新版本时使用。用于在发布前静态扫描并拦截「cmd /c start 截断 URL」「open -n 假装开新窗口」等只在非 macOS 端暴露的历史坑，并输出跨端人工验证清单。.
release-manager
Manage software releases end-to-end: bump version, generate changelog, tag, push, GitHub release, publish to PyPI/npm. Use when asked to ship, cut a release, or tag a version. Don't use for routine commits or marketplace publishing.
gem-release
Automates the complete process of releasing a new version of the openclacky Ruby gem. Supports both stable releases (auto-increment) and pre-release versions (user-specified, e.g., 1.0.0.beta.1). Handles version bumping, testing, building, RubyGems publishing, GitHub Releases, and OSS CDN mirroring.
lime-release-workflow
准备并执行 Lime 发版；覆盖版本号、发布说明、产物清理、验证门禁、commit、tag 和推送。.
release
Verify, sweep docs, cut a version — then hand the release sequence back.
flashinfer-submission-tagger
Create and push FlashInfer contest submission tags such as submission-v3 in a git repository. Use when the user asks to "tag your submission", "create a submission tag", "push the latest submission tag", or prepare a FlashInfer contest repo so the evaluator will use the latest tagged commit. Always validate…