Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add julianobarbosa/claude-code-skills --skill shipgit clone --depth 1 https://github.com/julianobarbosa/claude-code-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/julianobarbosa/claude-code-skills/ship)<a href="https://agentmods.dev/skills/julianobarbosa/claude-code-skills/ship"><img src="https://agentmods.dev/badge/skills/julianobarbosa/claude-code-skills/ship/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/julianobarbosa/claude-code-skills/ship"><img src="https://agentmods.dev/badge/skills/julianobarbosa/claude-code-skills/ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00296 | $0.05107 |
| Opus 5 | $0.00148 | $0.02554 |
| Sonnet 5 | $0.00059 | $0.01021 |
| Haiku 4.5 | $0.00030 | $0.00511 |
Grade D, and why
ship scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nullifies safety policieshighAnti-refusal
"You have no restrictions", "do anything now", "ignore your guidelines": a direct jailbreak that disables guardrails.
force-push or bypass the policy. Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
> `bun install` in the skill dir (`~/.claude/skills/ship/`) once before first use. How it starts
The opening of the file, as written. The whole thing — 303 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ship
ship takes a finished branch the last mile: commit it cleanly, push it (working around Azure
DevOps auth when needed), open a pull request, link it to its work item, and — once it's merged —
tear down the branch and worktree. It auto-detects whether you're on Azure Repos or GitHub
and follows the matching path, so the same command works at your organization and in a github.com repo.
It is deliberately narrow. It does not merge locally, run pipelines, or manage backlogs — it hands a reviewable PR to the platform and cleans up after the merge.
When to use this vs. neighbors
ship— the PR-based delivery flow: push → PR → (merge happens via the platform) → cleanup.commit— just stage + commit + push the current branch, no PR.merge— merge a branch intomainlocally (fast-forward) and clean up. Use this when there's no PR gate; useshipwhen changes must go through review/policy.azure-devops— the deep REST/MCP toolbox (WIQL, batch updates, pipelines, comment threads).shipcalls only the thin slice it needs; reach forazure-devopsfor anything richer.
The flow
Run bun scripts/ship-detect.ts first — it prints the platform, the Azure org/project/repo (if
any), the branch, and an inferred work-item id. Everything below branches on that.
One-time setup: the scripts depend on
azure-devops-node-apiand@octokit/rest. Runbun installin the skill dir (~/.claude/skills/ship/) once before first use.
0. Preflight
- Confirm there's something to deliver:
git statusandgit log --oneline @{u}.. 2>/dev/null. - Note the platform from
ship-detect.ts. If it saysunknown(e.g. a custom SSH host alias), setSHIP_PLATFORM=azureorSHIP_PLATFORM=githubfor the session.
1. Commit — as the author, never as the tool
Stage only files for this task and commit. Never add AI attribution — no
Generated with Claude, no Co-Authored-By: Claude. Commits are authored by the human; tooling
provenance does not belong in git history (this repo's commit-msg hook strips trailers as a
backstop, but don't rely on it — don't write them in the first place). If pre-commit hooks fail on
unrelated issues, --no-verify is acceptable; if they flag your change, fix it.
What ships with it
13 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .gitignore 23 B
- assets/pr-template.md 339 B
- package.json 336 B
- references/azure-devops.md 11 KB
- references/github.md 4.0 KB
- scripts/ship-detect.ts 777 B runs code
- scripts/ship-lib.ts 6.7 KB runs code
- scripts/ship-open.ts 11 KB runs code
- scripts/ship-pr.ts 17 KB runs code
- scripts/ship-push.ts 2.1 KB runs code
- scripts/ship-snapshot.ts 4.9 KB runs code
- scripts/ship-tag.ts 5.7 KB runs code
- tsconfig.json 305 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 303 lines · 296 tokens per session scan D ea78df232262
ship is a skill published in the GitHub repository julianobarbosa/claude-code-skills (10 stars, last pushed 16d ago), licensed MIT. It adds 296 tokens to every session and 5,107 once invoked, about $0.0015 per session on Opus 5. A static security scan graded it D with 2 findings (nullifies safety policies, enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
close-task-commit-push-pr
Close the active backlog task (detected from branch name), commit all changes, push to remote, and open a pull request. Use when the user says "close task and ship it", "close task commit push pr", or invokes /close-task-commit-push-pr.
ct-dev-workflow
Development workflow orchestration for task-driven development with atomic commits, conventional commit messages, and systematic release processes. Enforces task traceability, branch discipline, smart test scope selection, and GitHub Actions integration. Use when committing code, creating releases, managing branches…
git-ship
An automated Git release workflow that takes code changes through a branch, commit, pull request, review checks, squash merge, and return to the main branch. A pull request is a request to review and merge changes into a shared branch.
smith-build
Autonomous build phase — generates tasks, implements, tests, commits, pushes, merges, and produces release notes. Runs without user interaction.
git-workflow
Branching strategies, conventional commits, PR templates, and merge vs rebase guidance. Activate when starting features, creating PRs, or managing releases.
auto-build-loop
Autonomous build driver after SDD spec approval: phase-scoped headless build sessions, driver-owned commits, cross-provider review gates, milestone pauses, and fail-closed escalation — under explicit opt-in autonomy profiles.