Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/shipwrights/core/shipwrights-initnpx skills add shipwrights/core --skill shipwrights-initgit clone --depth 1 https://github.com/shipwrights/coreWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00076 | $0.01735 |
| Opus 5 | $0.00038 | $0.00868 |
| Sonnet 5 | $0.00015 | $0.00347 |
| Haiku 4.5 | $0.00008 | $0.00173 |
Grade A, and why
shipwrights-init scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/shipwrights-init — non-destructive project scaffold
Scaffold .shipwrights.yml + workflows + scripts + doc templates into a project. Never overwrites silently. Always lands as one git commit so undo is git revert HEAD.
Flags
--dry-run— print the plan, write nothing.--non-interactive— use defaults; for any conflict, write the plugin's version as.exampleand leave the consumer's file alone.--force— answer "overwrite" to every conflict prompt. Still lands as one commit.
What you (the init command) do
1. Pre-checks
- Confirm the working tree is clean. Refuse if dirty (unless
--force). - Confirm the cwd is a git repository (
git rev-parse --is-inside-work-tree). - Read existing
package.json/Cargo.toml/go.mod/pyproject.tomlto detect ecosystem. - Look for an existing
.shipwrights.yml. If present, refuse — direct user to/shipwrights-upgrade.
2. Auto-discovery
Run lib/verify-discovery.mjs against the project root. It returns a recipe:
{
ecosystem: "node-pnpm" | "node-npm" | "node-yarn" | "go" | "rust" | "python-poetry" | "python-uv" | ...,
install: "pnpm install" | ...,
verify: "pnpm verify" | "go test ./..." | ...,
lint: "pnpm lint" | "cargo clippy" | ...,
typecheck: "pnpm typecheck" | "tsc --noEmit" | ...,
format_fix: "pnpm exec biome check --write" | "gofmt -w ." | ...
}
Detect:
- Languages present (file extensions sampled).
- Monorepo vs single-package (
pnpm-workspace.yaml,lerna.json,turbo.json,Cargo.tomlwithworkspace,go.work). - Existing CI workflows under
.github/workflows/. - Existing branch protection (warn if
mainallows direct push). - Existing scripts under
scripts/architecture/(if so, propose registering them as guards).
3. Ask the consumer
Show the discovered recipe + propose questions. Each question has a default the consumer can accept by hitting Enter:
Project name? [shop-app-v2]
Integration branch? [dev]
Release branch? [main]
Verify command? [pnpm verify]
Format-fix command? [pnpm exec biome check --write]
Backlog source? [files] (other options will be available once @shipwrights/source-* packages installed)
Where do epic files live? [docs/backlog/epics]
Which roles to enable?
[x] po
[x] backend
[x] frontend
[x] qa
[x] gatekeeper
[ ] browser (auto-checked if apps/web/-style dir detected)
For backend, scope paths? [apps/api/**, packages/contracts/**]
For frontend, scope paths? [apps/web/**, packages/contracts/**]
For qa, scope paths? [**/*.test.ts, **/*.spec.ts, **/test/**]
Contract surface (frozen after slice)? [packages/contracts/**]
Push scratch branches to remote? [no]
Default merge strategy? [rebase]
File-length defaults?
TypeScript source: [250] test: [350]
Hard rules (one per line, blank to finish):
> Public APIs expose slugs / reference numbers, never raw DB ids
> Append-only ledgers stay append-only
>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 155 lines · 76 tokens per session scan A c0b753770d5f
shipwrights-init is a skill published in the GitHub repository shipwrights/core (2 stars, last pushed 1mo ago), licensed MIT. It adds 76 tokens to every session and 1,735 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
rtk-triage
Triage complet RTK : exécute issue-triage + pr-triage en parallèle, puis croise les données pour détecter doubles couvertures, trous sécurité, P0 sans PR, et conflits internes. Sauvegarde dans claudedocs/RTK-YYYY-MM-DD.md. Args: "en"/"fr" pour la langue (défaut: fr), "save" pour forcer la sauvegarde.
campaign-conductor
Run a project as an orchestrated campaign: Claude as conductor (Fable, or Opus when Fable is unavailable) dispatching a mixed fleet of workers, Claude Opus agents for UI/UX and design judgment, OpenAI Codex CLI workers for implementation and everything else. Use whenever the user says "start a campaign", "campaign…
foundry-config-setup
Resolve missing setup caused by a hardcoded Foundry project endpoint or model in a sample. Use when a sample fails because it uses a placeholder/hardcoded projectendpoint (for example "https://your-project.services.ai.azure.com") or a hardcoded model instead of reading them from the environment.
security-ownership-map
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for…
reflect
Review recent work, find repeated workflow patterns, and suggest reusable skills, agents, commands, config changes, or playbooks. Use when the user asks to learn from past sessions, improve recurring workflows, or identify what should be turned into reusable agent instructions.
codemap
Generate comprehensive hierarchical codemaps for UNFAMILIAR repositories. Expensive operation - only use when explicitly asked for codebase documentation or initial repository mapping.