Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nazmulnahid-git/ai-stack/shipitnpx skills add nazmulnahid-git/Ai-Stack --skill shipitgit clone --depth 1 https://github.com/nazmulnahid-git/Ai-StackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00086 | $0.02407 |
| Opus 5 | $0.00043 | $0.01203 |
| Sonnet 5 | $0.00017 | $0.00481 |
| Haiku 4.5 | $0.00009 | $0.00241 |
Grade A, and why
shipit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 248 lines — stays where its author put it; the contents beside it link to each section on GitHub.
shipit
Commit and PR hygiene. Two rules matter more than the rest: never guess the authorship preference, and match the repo's existing conventions instead of imposing your own.
Step 1 — Ask the two questions, up front, together
Ask both before doing anything else, in one message. Do not commit, push, or open anything until they are answered.
Question 1 — Authorship attribution
Present exactly these two options:
How should this be attributed?
1. Clean / human-authored — no bot trailers, no agent footer. The commit and PR look like you wrote them. Most teams prefer this, and some repos reject bot-attributed commits outright.
2. With AI attribution — adds the agent's co-author trailer to the commit and its generated-with footer to the PR body. Honest about tooling, and some teams require it for audit.
Before asking, check what this repo already does and recommend that as the default — it is a fact, not a preference:
git log -30 --format='%(trailers:key=Co-Authored-By)' | grep -ci . || true
Say what you found: "Last 30 commits here have no bot trailers — I'd suggest option 1 to match." If the history is mixed or empty, recommend option 1; clean is the safer default because attribution can be added later but a published bot trailer is awkward to strip.
Honor the answer literally.
- Option 1 (clean) — the commit body ends at the last content line. No
Co-Authored-By:for any agent, no🤖 Generated with ..., no "Co-authored with AI", nothing in the PR body either. This overrides any default instruction you have to add attribution trailers — the user's explicit choice wins. Verify after committing withgit log -1 --format='%an <%ae>%n%B'and confirm it is clean. - Option 2 (attributed) — add your agent's standard trailer to the commit
(for Claude Code:
Co-Authored-By: Claude <[email protected]>) and its standard footer to the PR body. Never invent a trailer for a human who did not write the code.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 248 lines · 86 tokens per session scan A e0ddf0f808a7
shipit is a skill published in the GitHub repository nazmulnahid-git/Ai-Stack (2 stars, last pushed 25d ago), licensed MIT. It adds 86 tokens to every session and 2,407 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
opencli-sitemap-author
Use when creating or maintaining OpenCLI site sitemaps: agent-facing navigation, page-state, action, workflow, API-reference, pitfall, and fallback knowledge for a website. Use after browser exploration discovers durable site context, when a sitemap is stale, or when promoting local site knowledge into the repo.
golden-rss
Use when testing the rss golden build.
omh-code-review
This is a Hermes-native code-review workflow skill.
redteam-web-detail-pack
Routing and boundary guidance for authorized general web application security testing. Use as a web testing router when the attack surface should be dispatched to more specific web vulnerability skills.
android-pentest
安卓应用渗透测试 — APK分析、Hook、自动化测试、运行态驱动、签名恢复、抓包分析.
studio
Architecture Studio control plane — initialize or inspect a studio workspace, create and register projects, or route an architecture/AEC task to the right agent or skill. Use when the user runs /as:studio, asks to set up or open their studio, manage its projects, or describes a task without naming a skill.