Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/heliohq/ship/handoffnpx skills add heliohq/ship --skill handoffgit clone --depth 1 https://github.com/heliohq/shipWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/heliohq/ship/handoff)<a href="https://agentmods.dev/skills/heliohq/ship/handoff"><img src="https://agentmods.dev/badge/skills/heliohq/ship/handoff.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.05964 |
| Opus 5 | $0.00028 | $0.02982 |
| Sonnet 5 | $0.00011 | $0.01193 |
| Haiku 4.5 | $0.00006 | $0.00596 |
Grade A, and why
handoff scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 607 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ship: Handoff
Do not stop when the PR is created. Do not stop while any GitHub check is pending. If any GitHub check fails, fix the problem, push again, and wait again. If the PR is not merge-ready, sync with base or resolve conflicts inside the same fix loop.
This is a goal-directed loop, not a counted one. Keep looping while each round makes progress toward the completion conditions; escalate on evidence, never on a round counter — the specific evidence classes are in Loop Governance. Done means every condition in Completion is satisfied.
Process Flow
Phase index — the phases below own the detail:
- Pre-flight (resolve branch, base, and scope)
- Verify locally
- Update changelog / directly affected docs
- Push and create/update the PR
- Wait for GitHub checks
- Fix loop — governed by the round ledger, not a counter
Red Flag
Never:
- Stop when the PR is created — #1 failure mode
- Push code changes without re-running relevant local verification
- Force push without
--force-with-lease - Rewrite an already-pushed PR branch when there are human review, approval, or shared-branch signals
- Treat
pendingchecks as "good enough" - Treat green checks as sufficient when
mergeStateStatusis still blocked - Create the PR before local verification runs
- Use
git add -Awhen unrelated local changes are present - Forget to stage and commit changelog or doc edits before the first push
- Mark a thread or comment as resolved before the fix is actually pushed
- Resolve comments that still need product, security, or architecture judgment
- Silently ignore a comment — a decline is a visible reply with a reason
- Apply "further fixes add no value" to CI or merge-readiness — that judgment exists only for the comment decline classes
- Fix failures without reading the actual check logs or review comments
- Sync with base preemptively — only when drift, conflicts, or repo policy require it
- Re-attempt a fix for a failure signature that already survived a fix aimed at it — the second identical outcome is evidence the approach is wrong; escalate with the ledger instead of iterating on hope
- Count rounds as a stopping condition — progress, judgment, and external blockers are the only reasons to stop looping
- Leave doc debt implicit — carry it into the PR
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 607 lines · 56 tokens per session scan A 1e4b7a85cf89
handoff is a skill published in the GitHub repository heliohq/ship (92 stars, last pushed 2mo ago), licensed MIT. It adds 56 tokens to every session and 5,964 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
git-workflow-and-versioning
Structures git workflow practices. Use when making any code change. Use when committing, branching, resolving conflicts, opening or reviewing a pull request (PR), pushing to a remote, or when you need to organize work across multiple parallel streams. Use when cutting a release, choosing a semantic version bump…
git-workflow
Git 工作流专家。规范化版本控制，确保提交历史清晰可追溯。支持 Conventional Commits 规范、Pull Request 最佳实践、分支管理策略和自动化工作流。.
git-branchless
Use when asked for multi-commit stack edits, rebases, fixups, or stacked-PR publishing with branchless git idioms. Not for plain-git workflows in repos without branchless.
git-authoring
Authors and executes git work end to end — Conventional Commits messages, pull-request content, release notes, and pull-request review, plus the repository operations an engineer runs daily: branching, rebasing, squashing, cherry-picking, reverting, merge-conflict resolution, stashes, tags, remotes, and recovery…
wednesday-git
Unified Git workflow. Manages the entire task lifecycle: branch creation (sprint), atomic commits (git-os), and PR opening (pr-create).
smart-git-commit
Use this skill for ANY git operation — commits, pushes, PRs, releases, or version tagging. Triggers on: "commit", "push", "save my changes", "create a PR", "open a pull request", "ship this", "make a release", "tag this version", "checkpoint my work", or any request to record or publish code changes. Produces…