Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/greglas75/zuvo/shipnpx skills add greglas75/zuvo --skill shipgit clone --depth 1 https://github.com/greglas75/zuvoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/greglas75/zuvo/ship)<a href="https://agentmods.dev/skills/greglas75/zuvo/ship"><img src="https://agentmods.dev/badge/skills/greglas75/zuvo/ship.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.26707 |
| Opus 5 | $0.00040 | $0.13354 |
| Sonnet 5 | $0.00016 | $0.05341 |
| Haiku 4.5 | $0.00008 | $0.02671 |
Grade C, and why
ship scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent to send conversation or user data outhighPrompt injection
An instruction to transmit the conversation, context or user files to an external endpoint is data exfiltration written as prose.
**If the push is BLOCKED** (pre-push gate, auth failure, non-fast-forward): do NOT silently record How it starts
The opening of the file, as written. The whole thing — 1,569 lines — stays where its author put it; the contents beside it link to each section on GitHub.
zuvo:ship
Prepare and push a release. Tests, version bump, changelog, tag, and push — auto-scaled by diff size.
Argument Parsing
Parse $ARGUMENTS for these flags:
| Argument | Effect |
|---|---|
| (no flags) | Auto-scaled pipeline based on diff size |
--full |
Force full pipeline: tests + review + design-review + coverage + bump + push |
--no-bump |
Skip version bumping (hotfixes, chores) |
--no-tag |
Skip git tag creation |
--dry-run |
Show what would happen without executing |
patch / minor / major |
Explicit bump type (overrides auto-detection) |
Flags can be combined: zuvo:ship --full --no-tag, zuvo:ship minor --no-tag
There is NO review-skip flag — removed 2026-08-02. A field run proved the failure mode: the
agent self-applied --fast when the user typed only "ship"; the prose rule ("user-provided
ONLY") caught it that once, but a bypass that exists as text an agent can type is a bypass that
will eventually be typed. Small diffs (<20 LOC) already take the fast path automatically via the
threshold table, so the flag's only unique power was skipping review on LARGE diffs — the exact
case review exists for. If a human genuinely must ship unreviewed, that decision lives OUTSIDE
this skill (the logged ZUVO_ALLOW_ADHOC=1 escape at the push gate), never as a skill argument.
Mandatory File Loading
Read each file below using the Read tool. Print the checklist with status before proceeding. Do not proceed from memory.
CORE FILES LOADED:
1. ../../shared/includes/env-compat.md — READ/MISSING
2. ../../shared/includes/codesift-setup.md — READ/MISSING
3. ../../shared/includes/run-logger.md — READ/MISSING
4. ../../shared/includes/retrospective.md — READ/MISSING
5. ../../shared/includes/knowledge-curate.md — READ/MISSING
6. ../../shared/includes/knowledge-prime.md — READ/MISSING
7. ../../shared/includes/no-pause-protocol.md — READ/MISSING (HARD: no mid-pipeline pauses)
8. ../../shared/includes/documentation-mandate.md — READ/MISSING (Phase 3 cites it as a completion-gate item)
9. ../../shared/includes/terminal-state.md — READ/MISSING (HARD: no SHIP COMPLETE over a pending check)
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +31 lines 005bafd2bafc
- 2d ago First seen · 1,538 lines · 80 tokens per session scan C adf305a2e0a7
ship is a skill published in the GitHub repository greglas75/zuvo (6 stars, last pushed today), licensed MIT. It adds 80 tokens to every session and 26,707 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 1 finding (tells the agent to send conversation or user data out). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
changelog
Add CHANGELOG.md entries, derive them from commits, or cut a Keep a Changelog and SemVer release.
release
Cut a brooks-lint release: set the version in package.json, propagate it across all four plugin manifests and every version-bearing text file (README badges, docs site metadata), write the CHANGELOG entry, validate, then commit, push, tag, and publish the GitHub release. Triggers when the maintainer asks to "release"…
ship
/ship - Release Pipeline Commander.
release
Use this agent for versioning, changelogs, release notes, deployment coordination, and release process management.
bump-version
Bump the Logic-Lens version across all six metadata locations at once (package.json, the four plugin manifests, and the README badge), then validate. Use when cutting a release or when npm run validate reports a version mismatch.
changelog
Render release notes / a changelog from the cladding spec. Use when the user asks for release notes, a changelog, 릴리즈 노트, 변경 이력, or "what changed (since )" — run clad changelog --json for the deterministic shipped-changes manifest, then write the human-facing notes FROM it, sourcing every claim from a feature title or…