ship-preflight

ship-preflight is a skill for Claude Code from easyinplay/harnessed. It costs 62 tokens per session (1,127 once invoked), scanned A, original, Apache-2.0.

A read-only release check that decides whether a project is ready to be tagged for release. It checks the unreleased changelog, package version, clean Git working tree, and absence of the version tag.

In plain words
What is it for?
Checking release readiness before creating a pull request, tag, or deployment; it does not publish, push, or create tags.
Why use it?
It catches missing release notes, invalid versions, uncommitted changes, or reused tags before shipping. Failing checks stop the release process.

Skill for Claude Code

Written for Claude Code: $ARGUMENTS substitution. Also seen: mentions subagents.

Good fit Checking release readiness before creating a pull request, tag, or deployment; it does not publish, push, or create tags.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/easyinplay/harnessed/preflight
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add easyinplay/harnessed --skill preflight
Clone the repo
git clone --depth 1 https://github.com/easyinplay/harnessed

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ship-preflight

README.md
[![agentmods](https://agentmods.dev/badge/skills/easyinplay/harnessed/preflight/github.svg)](https://agentmods.dev/skills/easyinplay/harnessed/preflight)
Your own site
<a href="https://agentmods.dev/skills/easyinplay/harnessed/preflight"><img src="https://agentmods.dev/badge/skills/easyinplay/harnessed/preflight/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for ship-preflight

Your own site · 80×15
<a href="https://agentmods.dev/skills/easyinplay/harnessed/preflight"><img src="https://agentmods.dev/badge/skills/easyinplay/harnessed/preflight.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 62 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,127 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00062 $0.01127
Opus 5.5 $0.00025 $0.00451
Sonnet 5.5 $0.00012 $0.00225
Haiku 4.5 $0.00006 $0.00113

Measured 25d ago against content hash eee0a0255b66, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

ship-preflight scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

workflows/ship/preflight/SKILL.md · 65 lines

How it starts

The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.

ship-preflight (Stage ⑤.a)

Overview

The machine-checkable "PR ready != release ready" gate. Runs the harnessed-native harnessed release-preflight command, which inspects (read-only) whether the repo is ready to tag a release:

check passes when
changelog ## [Unreleased] has entries (this release is documented)
version package.json has a valid semver
git-clean the working tree has no uncommitted changes
tag-absent a v<version> tag does NOT already exist

Process

  1. Run harnessed release-preflight.
  2. If any check fails, STOP — surface the fix: hints and do not proceed to PR/tag.
    • Empty [Unreleased] is the most common failure: document the release first.
  3. If all pass, the repo is tag-ready. The ship master continues to PR/deploy.

Boundary

This gate is READ-ONLY. It never pushes, publishes, or creates a tag. The actual npm publish + GitHub release happen in publish.yml CI when a v<version> tag is pushed (with explicit user approval).

How to invoke

!harnessed checkpoint intent ship-preflight

The banner above (when present) means this invocation is REGISTERED with the engine (an intent marker) — not yet compliant: the steps below (prompt → spawn → checkpoint complete) resolve it, and a per-turn <workflow-intent> reminder persists until they run.

The numbered sequence below is the state machine — execute it with Bash. Do NOT improvise an equivalent flow from the Overview above: freelancing bypasses the engine (no ledger, no evidence guard). harnessed gives you the spawn-ready prompt; YOU spawn the subagent with a {{ host.native }} {{ host.spawn_subagent }} (keeps the session responsive + lets clarification round-trips reach the user).

Do NOT pipe to harnessed run ship-preflight — that is the CI/headless path ({{ host.harnessed_run_warning_note.execution_tail }}

  1. Bash: harnessed prompt ship-preflight --task "$ARGUMENTS" --json → parse {prompt, max_iterations, model}.
  2. Spawn a {{ host.native }} subagent ({{ host.spawn_subagent }}) with that prompt and model, then drive delivery with harnessed's own completion gate:
    • on return, write the subagent's final output to a file and run harnessed checkpoint complete ship-preflight --result-file <path> — it is fail-closed on the declared artifacts, the TDD boundary, and the verbatim <promise>COMPLETE</promise>.
    • if it blocks, run harnessed checkpoint fail ship-preflight --failing-tests <n> to record the attempt; it prints BUDGET-EXHAUSTED / NO-PROGRESS / BREAK-LOOP when a stop condition is reached.
    • respawn ONLY while none of those three has fired. Any one of them means stop: re-scope the subtask, fix the blocker, or escalate to the user. Never respawn past a stop directive.
  3. If the output contains STATUS: NEEDS_CLARIFICATION + a question list: STOP, relay them verbatim via {{ host.ask_user }}, append the answers to the spec, then re-spawn the same sub.
  4. On <promise>COMPLETE</promise>: write the subagent’s final output to a file, then Bash harnessed checkpoint complete ship-preflight --result-file <path> --summary "<one-line>". Fail-CLOSED — it blocks unless every declared artifacts_expected file exists, the TDD boundary passes (non-empty evidence / both the red and green sides present / the test file was not deleted), and the result carries a verbatim <promise>COMPLETE</promise> (or a structured COMPLETE status). --result <text> is the inline variant; --result-file wins and is quoting-safe on Windows. --force records an audited override (evidence_status=overridden) — it does not silently pass.
  5. If the complete gate blocked: Bash harnessed checkpoint fail ship-preflight --failing-tests <n> to record the attempt. It prints BUDGET-EXHAUSTED / NO-PROGRESS / BREAK-LOOP once a stop condition is reached. Respawn ONLY while none of those three has fired; any one of them means STOP — re-scope the subtask, fix the blocker, or escalate to the user.

Read the full file on GitHub · 65 lines

Files

What ships with it

2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 25d ago Changed · -1 lines eee0a0255b66
  2. 1mo ago First seen · 66 lines · 62 tokens per session scan A 45768d8efd29

Subscribe to this mod's changes

ship-preflight is a skill published in the GitHub repository easyinplay/harnessed (2 stars, last pushed 3d ago), licensed Apache-2.0. It adds 62 tokens to every session and 1,127 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

release

CONTRIBUTOR TOOL - Cut a plugin release: bump plugin.json version, finalize CHANGELOG, update README if needed, gate on make ci, commit, tag vX.Y.Z, and create the GitHub release. Use when shipping a new plugin version. NOT distributed.

oliver-kriska/claude-elixir-phoenix · 60 tokens

create-release-checklist

Create a release checklist and GitHub issue for an R package. Use when the user asks to "create a release checklist" or "start a release" for an R package.

posit-dev/skills · 41 tokens

han-release

Cut a Han release: update CHANGELOG.md with the changes since the last release, bump and tag every plugin that changed as {plugin-name}--v{version} so a version-constrained dependency can resolve, and publish a GitHub release crediting every merged pull request and closed issue to the people behind it. Use when…

testdouble/han · 172 tokens

push-ci

Push to remote and monitor CI. Validates branch safety, executes git push WITH explicit user approval, then monitors CI run status via gh CLI. Use when: user says 'push', 'push and watch CI', 'ship it', 'push-ci'. Not for: committing (use /smart-commit), creating PRs (use /create-pr), merging (use /merge-prep).

sd0xdev/sd0x-harness · 82 tokens

bump-version

A procedure for changing a package and plugin version in several project files at the same time.

sd0xdev/sd0x-harness · 61 tokens

update

Safe cc10x upgrade through the Claude Code plugin CLI. Lists every installed scope, refreshes the marketplace, updates each scope, and optionally carries local patches over to the new install. Use this skill when: updating cc10x, upgrading, pulling latest cc10x, syncing plugin, refreshing cache, or checking for new…

romiluz13/cc10x · 108 tokens