Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add heliohq/ship --skill handoffgit clone --depth 1 https://github.com/heliohq/shipWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/heliohq/ship/handoff)<a href="https://agentmods.dev/skills/heliohq/ship/handoff"><img src="https://agentmods.dev/badge/skills/heliohq/ship/handoff/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/heliohq/ship/handoff"><img src="https://agentmods.dev/badge/skills/heliohq/ship/handoff.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 386 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 481 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Memory Poisoning · line 234 Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.Fix: Do not allow untrusted input to persist in agent memory or context. Validate all content before storing and implement memory isolation between sessions.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.05964 |
| Opus 5.5 | $0.00022 | $0.02386 |
| Sonnet 5.5 | $0.00011 | $0.01193 |
| Haiku 4.5 | $0.00006 | $0.00596 |
Grade A, and why
handoff scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 607 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ship: Handoff
Do not stop when the PR is created. Do not stop while any GitHub check is pending. If any GitHub check fails, fix the problem, push again, and wait again. If the PR is not merge-ready, sync with base or resolve conflicts inside the same fix loop.
This is a goal-directed loop, not a counted one. Keep looping while each round makes progress toward the completion conditions; escalate on evidence, never on a round counter — the specific evidence classes are in Loop Governance. Done means every condition in Completion is satisfied.
Process Flow
Phase index — the phases below own the detail:
- Pre-flight (resolve branch, base, and scope)
- Verify locally
- Update changelog / directly affected docs
- Push and create/update the PR
- Wait for GitHub checks
- Fix loop — governed by the round ledger, not a counter
Red Flag
Never:
- Stop when the PR is created — #1 failure mode
- Push code changes without re-running relevant local verification
- Force push without
--force-with-lease - Rewrite an already-pushed PR branch when there are human review, approval, or shared-branch signals
- Treat
pendingchecks as "good enough" - Treat green checks as sufficient when
mergeStateStatusis still blocked - Create the PR before local verification runs
- Use
git add -Awhen unrelated local changes are present - Forget to stage and commit changelog or doc edits before the first push
- Mark a thread or comment as resolved before the fix is actually pushed
- Resolve comments that still need product, security, or architecture judgment
- Silently ignore a comment — a decline is a visible reply with a reason
- Apply "further fixes add no value" to CI or merge-readiness — that judgment exists only for the comment decline classes
- Fix failures without reading the actual check logs or review comments
- Sync with base preemptively — only when drift, conflicts, or repo policy require it
- Re-attempt a fix for a failure signature that already survived a fix aimed at it — the second identical outcome is evidence the approach is wrong; escalate with the ledger instead of iterating on hope
- Count rounds as a stopping condition — progress, judgment, and external blockers are the only reasons to stop looping
- Leave doc debt implicit — carry it into the PR
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 607 lines · 56 tokens per session scan A 1e4b7a85cf89
handoff is a skill published in the GitHub repository heliohq/ship (94 stars, last pushed 4mo ago), licensed MIT. It adds 56 tokens to every session and 5,964 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
handoff compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| handoffheliohq/ship | Skill | 94 | 4mo ago | MIT | A | 56 | Claude Code |
| git-workflow-and-versioningaddyosmani/agent-skills | Skill | 115k | 8d ago | MIT | A | 131 | Claude Code |
| git-opsPrismer-AI/PrismerCloud | Skill | 1.4k | 18d ago | MIT | A | 62 | Claude Code |
| releasegtapps/hermitd | Skill | 84 | today | MIT | A | 104 | Claude Code, Codex |
| git-workflowhuangwb8/skills | Skill | 50 | yesterday | MIT | A | 47 | Claude Code, Codex |
| git-branchlessOutlineDriven/odin-claude-plugin | Skill | 40 | 1mo ago | Apache-2.0 | A | 45 | Claude Code, Codex |
| changelog-generatorborghei/Claude-Skills | Skill | 1.1k | yesterday | none | A | 48 | Claude Code |