pdlc-ship

pdlc-ship is a skill for Claude Code from kanfu-panda/pdlc-skills. It costs 0 tokens per session (2,527 once invoked), scanned A, original, MIT.

A software release workflow that runs tests, updates the version and change log, creates a Git tag, and starts CI/CD, the automated build and deployment process.

In plain words
What is it for?
Use it to prepare and publish a version after checking the branch, worktree, unfinished features, quality reports, and release tests.
Why use it?
It checks release prerequisites and requires human decisions before actions that can publish or trigger deployment. It also records when tests are skipped or quality requirements are overridden.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: mentions CLAUDE.md.

Part of the pdlc plugin — 38 skills shipped together

Good fit Use it to prepare and publish a version after checking the branch, worktree, unfinished features, quality reports, and release tests.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/kanfu-panda/pdlc-skills/pdlc-ship
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add kanfu-panda/pdlc-skills --skill pdlc-ship
Clone the repo
git clone --depth 1 https://github.com/kanfu-panda/pdlc-skills

Made for: Claude Code.

Or install pdlc, the plugin that ships this one along with the rest of its 38 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for pdlc-ship

README.md
[![agentmods](https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-ship/github.svg)](https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-ship)
Your own site
<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-ship"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-ship/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for pdlc-ship

Your own site · 80×15
<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-ship"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 0 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,527 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 4 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Tool Misuse · line 4
    Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
    Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
  • high Tool Misuse · line 64
    Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
    Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
  • high Prompt Injection · line 22
    Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
    Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
  • high Prompt Injection · line 22
    Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
    Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.02527
Opus 5 $0.00000 $0.01264
Sonnet 5 $0.00000 $0.00505
Haiku 4.5 $0.00000 $0.00253

Measured today against content hash 1611802a7f98, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

pdlc-ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/pdlc-ship/SKILL.md · 188 lines

How it starts

The opening of the file, as written. The whole thing — 188 lines — stays where its author put it; the contents beside it link to each section on GitHub.

发布工作流

串联发布一个版本所需的所有步骤:跑测试 → 升级 VERSION → 更新 CHANGELOG → 创建 tag → 推送触发 CI/CD。

发布是破坏性·不可逆操作:打 tag / bump 版本 / 触发 CI/CD 属破坏性范畴。--autonomous 对本命令无效——即使带该参数,§1.1(未完成功能)与 §1.2(测试门)的人工确认仍必须真实由人应答。自主循环(/pdlc-loop-run)的终态是 review_done,永不进入本命令。

段一:执行

1.1 前置检查

  1. 确认当前分支不是 master / main(参考 CLAUDE.md §5)

  2. 确认工作区干净(git status clean)

  3. 检查 docs/.pdlc-state/ 下是否有未完成的功能(current_stage 不在 [*_done] 的)

    • 有 → 列出来并询问是否继续(用户明确同意才继续)
    • 无 → 直接进入下一步
  4. 质量闸门检查(若项目有 docs/00_standards/quality-targets.yml): 读 docs/07_reviews/quality/最近一份 .md 报告(同名 .html 只是视图, 闸门一律以 .md 为准——两者若不一致,信 .md):

    • 无任何报告 → 提示先跑 /pdlc-quality,询问是继续还是先出报告
    • 报告总判定未达标默认不放行;要发必须由人显式 override 并写明理由, 该理由需记入本次发布的 CHANGELOG 或发布说明(不允许无声跳过)
    • 报告过期——分两档处理,不是所有过期都等价(见下)
    • 达标且未过期 → 在发布报告里引用该报告路径、日期与 commit SHA 作为质量证据
    过期判定:按「改动了什么」分两档

    报告头部记着生成时的 <!-- 仓库版本: <commit SHA> -->(由 /pdlc-quality 落盘时写入)。 取该 SHA,跑 git diff --name-only <SHA>..HEAD 看这期间动了什么:

    这期间改动命中 判定 理由
    docs/01_requirements/prd/docs/00_standards/quality-targets.ymldocs/00_standards/e2e-flow-map.ymldocs/00_standards/test-commands.yml 硬闸·不放行 报告里的 PRD ↔ core_flows 对账与 E2E 覆盖矩阵的输入变了,结论不再成立。重跑单测补不回对账——必须重跑 /pdlc-quality
    只有其它代码 / 文档 提示已过期,建议重跑 对账仍成立,测量数字可能略旧
    报告里没有 仓库版本 字段,或该 SHA 在本仓库解析不了 按「不可判」处理:明确告知无法核对新鲜度,建议重跑 与三态语义同一条纪律——「查不了」不等于「没问题」,不得静默当作未过期

    ⛔ 硬闸同样允许人显式 override 并写明理由(与「总判定未达标」同一条通道,理由须记入 CHANGELOG 或发布说明),但不得无声跳过

    quality-targets.yml 变动要单独看一眼「闸门是不是被调松了」

    若上表命中的文件里包含 quality-targets.yml,除了要求重跑,还必须把 git diff <SHA>..HEAD -- docs/00_standards/quality-targets.yml 原样展示给人, 并逐条点出下列「变松」信号——命中任何一条都要人明确确认,不得只当作普通过期

    • 覆盖率目标数字下降(如 85 → 70)
    • core_flows 条目减少(核心流被移出闸门视野)
    • lint 策略放宽(如 zero-warnings 改为允许若干 warning)
    • 新增了豁免声明(把某些 PRD / 流程排除在对账之外)

Read the full file on GitHub · 188 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +29 lines 1611802a7f98
  2. 11d ago First seen · 159 lines · 0 tokens per session scan A b47e683eceba

Subscribe to this mod's changes

pdlc-ship is a skill published in the GitHub repository kanfu-panda/pdlc-skills (13 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,527 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.