Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hamen/ship-feature --skill skillgit clone --depth 1 https://github.com/hamen/ship-featureWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hamen/ship-feature/skill)<a href="https://agentmods.dev/skills/hamen/ship-feature/skill"><img src="https://agentmods.dev/badge/skills/hamen/ship-feature/skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hamen/ship-feature/skill"><img src="https://agentmods.dev/badge/skills/hamen/ship-feature/skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00136 | $0.00937 |
| Opus 5.5 | $0.00054 | $0.00375 |
| Sonnet 5.5 | $0.00027 | $0.00187 |
| Haiku 4.5 | $0.00014 | $0.00094 |
Grade A, and why
ship-feature scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 63 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ship-feature
Follow the canonical workflow in ~/.config/ship-feature/WORKFLOW.md (installed by this project).
It is the single source of truth — do not restate or fork it here. Read it before your first change in
a session.
Pick the lane first
The careful lane is only for: payments and subscriptions; ad consent and ad-revenue paths; authentication and account deletion; database migrations and data deletion; security fixes; store-policy changes (permissions, SDKs that collect data); and any change the human puts there.
Everything else is the light lane. Say which lane you picked, and why, in one line.
The light lane (default)
- Work in a git worktree off the default branch (never the main tree). Stage explicit paths.
- Implement, with tests at the level you touched. Commit.
- Review once, with the configured panel, on the branch diff:
ship-feature review --author <self> --base origin/<default>. No--reviewers: the panel isREVIEWERSin~/.config/pr-review-relay/config, and its seats run in parallel. Name the seats that ran: a seat whose CLI is not installed is skipped and the round still exits0; a seat that fails (timeout, quota, no usable review), or a round where no seat ran, exits3. If the same seat fails twice, run the other seats with--reviewersand say which seat you dropped. - Fix only what breaks the change for a real user, loses money, or leaks data. Record the other
findings in the merge message (
-m "Not fixed: …"). No second round, unless the fix was large. ship-feature land [-m <message>]...from inside the worktree. The pre-push hook runs on the exact merged tree. If it refuses, nothing landed: fix what it reported, or runlandagain.- Ship it if the change needs a release or a deploy. Done means live: report the version or the deployed commit, not "merged".
No plan, no plan review, no PR, no human merge gate.
The careful lane
- Write a short plan in
~/.config/ship-feature/plans/<repo>-<slug>.md(mkdir -pit if missing; never the repo, never/tmp, which a reboot can wipe). ship-feature plan-review <that file>— one round, no--reviewers(the config is the panel). Read the startup lines and say which reviewers actually ran: a benched seat is dropped and the run still exits0. Fix the blockers in the plan.- 🚦 Stop for the human to approve the plan.
ship-feature preflight, implement in a worktree, open a PR.ship-feature relay --author <self> --context-file <plan> --max-rounds 2— two rounds at most: round 1 the full panel; round 2, only if round 1 raised a qualifying finding, the full panel on the SHA that will merge. Post dispositions before round 2. Whatever is still open after round 2 goes to the merge gate as an open item, not into a round 3.- 🚦 Stop for the human to merge. Never self-merge in this lane.
- Verify the tests on the merge commit.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · -39 lines · +42 tokens per session e1973679cdd7
- 4d ago Changed · +6 lines 31e19dafad0e
- 5d ago Changed · +2 lines fe12b1c0c9f2
- 21d ago Changed 903f1ba2d81d
- 1mo ago Changed · +12 lines f09d2cccb5bb
- 1mo ago First seen · 82 lines · 94 tokens per session scan A 7142f733e8b1
ship-feature is a skill published in the GitHub repository hamen/ship-feature (6 stars, last pushed yesterday), licensed MIT. It adds 136 tokens to every session and 937 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
prowler-commit
Creates professional git commits following conventional-commits format. Trigger: When creating commits, after completing code changes, when user asks to commit.
gh-auth-isolation
Safely manage multiple GitHub identities (EMU + personal) in agent workflows.
comet-github
A routing guide for Comet-related GitHub work. It directs requests about pull requests, issues, CI failures, ideas, and fixes to the appropriate review or implementation process.
release-helper
Ensures configuration and code changes are released correctly. Use PROACTIVELY whenever you edit config.json, change any setting, or fix a configuration bug in this project, so the change reaches production.
github-skill
Work with GitHub via the gh CLI — clone repositories, create/list/merge pull requests, create/list issues, and run any other gh command (API calls, workflow runs, releases, repo administration). List operations return parsed JSON.
re0-merge
Review and land an external contribution the way this suite does: gate it against the thesis, land it with the author's credit intact, complete a new skill rather than merging it raw, then approve, credit, and explain before closing. Use when reviewing a pull request, as any collaborator or maintainer, not only the…