A workflow skill for taking a completed code change through branch checks, quality checks, commit, push, and pull-request creation. A pull request is a proposed change submitted for review before being merged.

Use it when asked to ship a change, deploy it, open a pull request, or push finished work for review.

It provides a repeatable release path and stops the change when the required lint, type, test, or secret checks fail.

ship — Skill for Claude Code and Codex by HumanDealer/vibeproof

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add HumanDealer/vibeproof --skill ship

Clone the repo

git clone --depth 1 https://github.com/HumanDealer/vibeproof

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/humandealer/vibeproof/ship/github.svg)](https://agentmods.dev/skills/humandealer/vibeproof/ship)

Your own site

<a href="https://agentmods.dev/skills/humandealer/vibeproof/ship"><img src="https://agentmods.dev/badge/skills/humandealer/vibeproof/ship/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/humandealer/vibeproof/ship"><img src="https://agentmods.dev/badge/skills/humandealer/vibeproof/ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 32 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 538 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00032	$0.00538
Opus 5.5	$0.00013	$0.00215
Sonnet 5.5	$0.00006	$0.00108
Haiku 4.5	$0.00003	$0.00054

Measured 1mo ago against content hash 4c4cbc2c2b01, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/ship/SKILL.md · 63 lines

What it actually says

Ship

Take a finished change from working tree to an open PR. This skill runs the real gate — vibeproof check — and stops if it returns BLOCKED. It does not "enforce" by willpower: the deny-list (templates/settings.deny.json) is what physically blocks a push to main or a --no-verify. This skill is the happy path that respects those gates.

When to use

The human says "ship it", "deploy this", "open a PR", "push it up", or the implementation is done and the next step is to land it.

Steps

Confirm you're not on a protected branch.
```
git branch --show-current
```
If main / master / production → create a feature branch now: git checkout -b <type>/<scope>-<desc> (see rules/git-workflow.md).
Run the gate (rules/code-quality.md):
```
vibeproof check        # lint · types · tests · secret scan, one verdict line
```
Proceed only on READY. On BLOCKED, fix the ✗ lines — do not proceed on red. Paste the verdict line as your evidence; "looks good" is not evidence.
Review the diff yourself.
```
git diff
```
No secrets, no debug prints, no commented-out code, no stray files.
Commit atomically. One logical change per commit, message in <type>(<scope>): <summary> format (rules/git-workflow.md).
Push the branch.
```
git push -u origin <branch>
```
Open the PR with a Summary (what + why) and a Test plan (how you verified). Use the repo's PR template if present.
Wait for CI to be green. A failure → read the log, fix the root cause, push the fix. Never merge red.
Merge (squash/rebase per convention), delete the branch, return to a fresh main.

Never

Push straight to main.
--no-verify or [skip ci].
Claim shipped before CI is green.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 63 lines · 32 tokens per session scan A 4c4cbc2c2b01

Subscribe to this mod's changes

ship is a skill published in the GitHub repository HumanDealer/vibeproof (2 stars, last pushed 4mo ago), licensed MIT. It adds 32 tokens to every session and 538 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Commits Git and workflow Releases agents-md ai-agents best-practices codex cursor

git-workflow-and-versioning

Structures git workflow practices. Use when making any code change. Use when committing, branching, resolving conflicts, splitting uncommitted work in a messy working tree into clean atomic commits, opening or reviewing a pull request (PR), pushing to a remote, or when you need to organize work across multiple…

addyosmani/agent-skills · 89 tokens

git-ops

Close out a local coding task on the bound daemon — stage, commit, branch, merge, push via cloud git — and when a merge conflicts, STOP and escalate with the file list instead of auto-resolving. Push reaches only the bare replica; prod-triggering tags are refused.

Prismer-AI/PrismerCloud · 62 tokens

infrastructure-publishing

Skill for the publishing infrastructure module providing academic publishing workflows including BibTeX CLI citation generation, APA/MLA citation helper functions, DOI management, Zenodo publication, arXiv submission preparation, GitHub releases, PyPI and TestPyPI package distribution, static-site deployment to GitHub…

docxology/template · 127 tokens

template-publish

Publishing scripts for DOI-bearing project releases, optional mirror uploads, PyPI release validation, post-publish verification, and publication export. Use with docs/guides/publication-runbook.md for standalone GitHub + Zenodo release workflows.

docxology/template · 52 tokens

cut-release

Cut a clean release — bump versions across all files, update changelog, create GitHub release.

TheSmuks/ai-project-template · 22 tokens

git-authoring

Authors and executes git work end to end — Conventional Commits messages, pull-request content, release notes, and pull-request review, plus the repository operations an engineer runs daily: branching, rebasing, squashing, cherry-picking, reverting, merge-conflict resolution, stashes, tags, remotes, and recovery…

n-shadloo/git-authoring · 225 tokens