ship

ship is a skill for Claude Code from rjmurillo/ai-agents. It costs 80 tokens per session (4,858 once invoked), scanned A, original, MIT.

A release workflow that runs four pre-flight checks, checks CI, and creates a pull request or validates a contributor branch. A pull request is a proposed change submitted for review before it is merged.

In plain words
What is it for?
Run pre-flight validation, detect the code-hosting service, check the target branch, and open or validate a pull request.
Why use it?
It combines the checks and branch handling needed before shipping, while avoiding changes to a contributor branch when validation is required.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: reads .claude/ paths; mentions Claude Code.

Part of the project-toolkit plugin — 114 skills, 25 commands, 33 agents, 5 hooks shipped together

Good fit Run pre-flight validation, detect the code-hosting service, check the target branch, and open or validate a pull request.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/rjmurillo/ai-agents/ship
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add rjmurillo/ai-agents --skill ship
Clone the repo
git clone --depth 1 https://github.com/rjmurillo/ai-agents

Made for: Claude Code.

Or install project-toolkit, the plugin that ships this one along with the rest of its 114 skills, 25 commands, 33 agents, 5 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ship

README.md
[![agentmods](https://agentmods.dev/badge/skills/rjmurillo/ai-agents/ship/github.svg)](https://agentmods.dev/skills/rjmurillo/ai-agents/ship)
Your own site
<a href="https://agentmods.dev/skills/rjmurillo/ai-agents/ship"><img src="https://agentmods.dev/badge/skills/rjmurillo/ai-agents/ship/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for ship

Your own site · 80×15
<a href="https://agentmods.dev/skills/rjmurillo/ai-agents/ship"><img src="https://agentmods.dev/badge/skills/rjmurillo/ai-agents/ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 80 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,858 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00080 $0.04858
Opus 5.5 $0.00032 $0.01943
Sonnet 5.5 $0.00016 $0.00972
Haiku 4.5 $0.00008 $0.00486

Measured today against content hash 4f83e95ef038, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/ship/SKILL.md · 272 lines

How it starts

The opening of the file, as written. The whole thing — 272 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Ship

Pre-flight validation, CI check, and PR creation, branching on VCS host and on whether the branch is yours.

Migrated from .claude/commands/ship.md under ADR-064, which makes skills the single user-invocable surface.

Triggers

ship it, ship this branch, run pre-flight and open the PR, is this ready to ship

Arguments

Ship: $ARGUMENTS

Default target is main unless specified. If $ARGUMENTS names a different branch, use that as the target.

Mode Detection

Run this block BEFORE the pre-flight checks. It sets two variables, host and mode, that branch every step below. State the detected host and mode in the ship report.

1. VCS host detection

Derive the host from the origin remote URL:

remote_url="$(git remote get-url origin 2>/dev/null || true)"
if [ -z "$remote_url" ]; then
  echo "ERROR: origin remote is not configured; cannot detect VCS host." >&2
  exit 2
fi
case "$remote_url" in
  *dev.azure.com*|*visualstudio.com*) host=ado ;;
  *) host=github ;;
esac
redacted_remote_url="$(printf '%s' "$remote_url" | sed -E 's#(https://)[^/@]+@#\1[redacted]@#')"
echo "host=$host (origin: $redacted_remote_url)"

dev.azure.com or visualstudio.com anywhere in the URL means host=ado; everything else is host=github. This match covers both Azure DevOps remote URL shapes:

  • HTTPS: https://dev.azure.com/<org>/<project>/_git/<repo> and the legacy https://<org>.visualstudio.com/<project>/_git/<repo>.
  • SSH: [email protected]:v3/<org>/<project>/<repo> and the legacy <org>@vs-ssh.visualstudio.com:v3/<org>/<project>/<repo>.

2. PR ownership and existence detection

Determine two facts:

  • (a) Branch ownership. Are you on a branch you own (you created it and push to it freely), or are you a contributor pushing commits onto someone else's feature branch? Treat a branch whose open PR lists a different author as not yours.
  • (b) Open PR exists for this branch. Query the host:
    • host=github: gh pr view --json number,author,state,url for the current branch. Treat the result as an open PR only when the JSON state field is exactly OPEN. A non-zero exit can mean "no PR exists" or "the query itself failed" (auth, network, API rate limit). Distinguish these: capture both stdout and stderr, then check whether stderr contains the documented no-PR message (e.g. "no pull requests found"). Only set pr=none on that specific signal. On any other non-zero exit, stop with an error; do not assume no PR exists.
    • host=ado: derive branch_ref="refs/heads/$(git rev-parse --abbrev-ref HEAD)", then run az repos pr list --source-branch "$branch_ref" --status active --output json. An empty array means no open PR for the branch.

Read the full file on GitHub · 272 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +4 lines 4f83e95ef038
  2. 10d ago Changed 71594d7bd0f9
  3. 14d ago Changed ec17ff99d0bb
  4. 18d ago Changed · +6 lines 9b59494c1919
  5. 28d ago Changed · +69 lines 0e3e0d0200ff
  6. 1mo ago Changed · +6 lines 99cbcd5fdb56
  7. 1mo ago First seen · 187 lines · 80 tokens per session scan A 98817a04afe4

Subscribe to this mod's changes

ship is a skill published in the GitHub repository rjmurillo/ai-agents (48 stars, last pushed today), licensed MIT. It adds 80 tokens to every session and 4,858 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-08.

Related

Other skills, from other repositories

review-this-branch

Run the nohuman review gate (fresh-session adversarial reviewer + tamper guard) over the current branch or a GitHub pull request, with no server, no database, and no onboarding, and relay the pass/fail checklist.

no-human-ai/no_human · 53 tokens

respond-to-pr-comments

Respond to pull request review comments on GitHub or Azure DevOps Services. Reads review threads, validates each, proposes fixes or explanations, applies changes with user confirmation, and updates thread status via the platform's API. Use when the user wants to address PR feedback or resolve review threads.

microsoft/PromptKit · 62 tokens

ai-pr

The pull-request loop, opened from the local main with no worktree: cut the pull-request branch from the local main, push it, open the pull request against main with a body assembled from the merge commits the branch carries, watch CI and the review comments, fix only what is obvious in bounded iterations, then merge…

arcasilesgroup/ai-engineering · 174 tokens

install-gemini-code-review-action

Installs, configures, or upgrades Dazbo's PR code review & issue triage GitHub Action (gemini-review-action) in a target repository. Use when the user wants to set up, configure, or update automated AI code reviews, issue triaging, or Gemini model workflows for their GitHub repository.

derailed-dash/dazbo-agent-skills · 73 tokens

gh-address-comments

Help address review/issue comments on the open GitHub PR for the current branch using gh CLI; verify gh auth first and prompt the user to authenticate if not logged in.

rojim666/SztuCode · 39 tokens

review-remote

Review open PR/MR and publish findings.

juliusz-cwiakalski/agentic-delivery-os · 13 tokens