Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sidcorp-co/forge/forge-shipnpx skills add SidCorp-co/forge --skill forge-shipgit clone --depth 1 https://github.com/SidCorp-co/forgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sidcorp-co/forge/forge-ship)<a href="https://agentmods.dev/skills/sidcorp-co/forge/forge-ship"><img src="https://agentmods.dev/badge/skills/sidcorp-co/forge/forge-ship.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00055 | $0.00768 |
| Opus 5 | $0.00028 | $0.00384 |
| Sonnet 5 | $0.00011 | $0.00154 |
| Haiku 4.5 | $0.00006 | $0.00077 |
Grade A, and why
forge-ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
forge-ship
The review approved. Two things left: land it, and account for it.
Merge
Into the base branch you checked out from. That is yours and needs no permission.
Resolve the target from the project's own configuration, not from the plan text and not from habit — a project whose base branch changed will have stale branch names written into older issue descriptions, and following them merges into the wrong place silently.
Merging anywhere else needs a human. Ask, do not assume.
If the merge conflicts, that is phase 3 again, not a failure: re-declare code, resolve, and come
back through review if the resolution changed behaviour.
Deploy gate
projectFacts.deploy-policy says whether a deploy happens on this project and what gates it. You
request it; the cloud allows it or does not. A refusal is not an error to work around — if deploy
is gated, the gate is the answer.
If a deploy runs and does not come up, do not close the issue. Comment with what you saw and set
needs_info. A green merge with a dead deploy is the exact state that looks finished and is not.
Account for it
One comment. It is the only record a human will read, so it carries everything that is not in the diff:
| Section | Content |
|---|---|
| What changed | one paragraph, in terms of the reported problem, not the files |
| Extra fixes | defects you fixed that were not in the acceptance criteria |
| Left unresolved | anything you found and did not fix, and why |
| Verification | what you ran, and what it said |
Left unresolved is not optional and it is not a confession. Something out of reach leaves as one
of: a blocks edge onto the issue that would ship without it, a line in docs/proposals/, or this
comment saying plainly that a human must decide. It does not leave as a new issue.
Changelog
One line under ## [Unreleased], written for someone who does not know this issue exists. If the
change is invisible to users, say so and write nothing — an entry that says "refactored internals"
is noise in a file people read to find out what changed for them.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 72 lines · 55 tokens per session scan A f4aaff881131
forge-ship is a skill published in the GitHub repository SidCorp-co/forge (5 stars, last pushed 3d ago), licensed Apache-2.0. It adds 55 tokens to every session and 768 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.
gh-credit-harvest
Harvest one community PR into a release branch with authorship and credit preserved, verified green, and a warm thank-you.
release
Prepare a named version: preflight, version consistency, build/package, smoke test, checksums/notes, and release readiness. Publishing/tagging/deploy need separate authorization. Explicit-only.
herdr-pre-release-audit
Audit herdr release readiness by comparing commits since the base release against next-release changelog and docs. Use when asked to run or apply the repo's pre-release audit, validate docs/next before release, inspect issue refs that release CI will close, or finalize release docs for herdr.
release-new-version
Release a new desktop stable version for Anarlog. Use when asked to cut, publish, or prepare a new stable desktop release after checking and merging the changelog.
new-changelog
Create the next desktop changelog entry when asked to add a changelog file or prepare the next release note under packages/changelog/content. Use this when the task is specifically about determining the next version and creating the markdown entry.