Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/snowflake-labs/cocoplus/shipnpx skills add Snowflake-Labs/cocoplus --skill shipgit clone --depth 1 https://github.com/Snowflake-Labs/cocoplusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/snowflake-labs/cocoplus/ship)<a href="https://agentmods.dev/skills/snowflake-labs/cocoplus/ship"><img src="https://agentmods.dev/badge/skills/snowflake-labs/cocoplus/ship.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00041 | $0.02225 |
| Opus 5 | $0.00020 | $0.01112 |
| Sonnet 5 | $0.00008 | $0.00445 |
| Haiku 4.5 | $0.00004 | $0.00222 |
Grade A, and why
ship scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
const { spawnSync } = require('child_process'); How it starts
The opening of the file, as written. The whole thing — 194 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are executing the Ship phase (6/6) of CocoBrew.
Before proceeding, verify that .cocoplus/ exists.
If not: output "CocoPlus not initialized in this directory. Run $pod init to begin." Then stop.
Read .cocoplus/lifecycle/meta.json. Verify phases_completed contains "review".
If not: output "The Review phase must be approved before shipping. Run $review first." Then stop.
Verify that required lifecycle artifact files exist on disk — meta.json alone is not sufficient:
- Check
.cocoplus/lifecycle/spec.mdexists. If not: output "spec.md is missing. Run$specto regenerate it before shipping." Then stop. - Check
.cocoplus/lifecycle/plan.mdexists. If not: output "plan.md is missing. Run$planto regenerate it before shipping." Then stop. - Check
.cocoplus/lifecycle/review.mdexists. If not: output "review.md is missing. Run$reviewto regenerate it before shipping." Then stop.
Read .cocoplus/lifecycle/review.md. Verify ## Approval Status contains APPROVED.
If not: output "Review has not been approved. Run $review to complete the approval process." Then stop.
Read .cocoplus/lifecycle/review-state.json if it exists. If any finding has severity: BLOCKED and resolved is not true:
Output: "Ship blocked: [N] unresolved BLOCKED finding(s) require a human decision before shipping. Run $review clear-blocked --id <finding-id> --rationale <text> to resolve each one." List each unresolved finding's ID and one-line summary. Then stop. BLOCKED findings are treated identically to BLOCKING findings — there is no override.
Determine Version
First inspect the current git branch and look for a semantic version token:
node -e "
const { spawnSync } = require('child_process');
const branch = spawnSync('git', ['branch', '--show-current'], { encoding: 'utf8' }).stdout.trim();
const match = branch.match(/(?:^|[^0-9])v?(\d+\.\d+\.\d+)(?:$|[^0-9])/);
console.log(JSON.stringify({ branch, version: match ? 'v' + match[1] : null }));
"
If the branch contains a version, normalize it to v<major>.<minor>.<patch> and use that as the release version unless the developer explicitly overrides it. Examples: feature/cocoplus-v1.2.0 and release/1.2.0 both resolve to v1.2.0.
If the branch does not contain a version, do not infer or auto-increment one. Prompt:
"The current git branch does not include a semantic version. What semantic version should this release be? (e.g., v1.2.0)"
Validate the developer's answer matches v<major>.<minor>.<patch> exactly. If it does not, re-prompt once. Use the developer's answer as the version.
Use existing tags only as context for the prompt:
node -e "
const { spawnSync } = require('child_process');
const tags = spawnSync('git', ['tag', '--list'], { encoding: 'utf8' }).stdout.trim().split(/\r?\n/).filter(Boolean);
const semver = tags.map(t => {
const m = t.match(/^v?(\d+)\.(\d+)\.(\d+)$/);
return m ? { tag: 'v' + m.slice(1).join('.'), nums: m.slice(1).map(Number) } : null;
}).filter(Boolean);
semver.sort((a,b)=>{ for(let i=0;i<3;i++){ if(a.nums[i]!==b.nums[i]) return b.nums[i]-a.nums[i]; } return 0; });
console.log(semver[0]?.tag || 'none');
"
When updating CHANGELOG.md, use the branch-derived release version. If that version already exists, append the new release notes under that version. If the version exists but the current month does not, create a new month subsection under that same version. If the branch has no version, ask for the version before editing the changelog.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 194 lines · 41 tokens per session scan A 485f3e7392bb
ship is a skill published in the GitHub repository Snowflake-Labs/cocoplus (720 stars, last pushed 2d ago), licensed MIT. It adds 41 tokens to every session and 2,225 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
release-validation
Use this skill when validating a MeshLLM release candidate or current HEAD against the last GitHub release, assembling the canonical feature/fix/modification inventory, testing locally built release bundles on user-approved real hosts and private meshes, deciding release readiness, or producing a formal…
changelog
Turn a range of commits or merged PRs into a changelog entry grouped by change type. Use when the user asks for release notes, a changelog, or "what changed" between two points.
changelog
Update per-package CHANGELOG.md files for a Ratel release. Drafts entries with git-cliff (scoped per package), lets you curate, then writes the CHANGELOGs. Handles both RC entries and GA-graduation collapse (merging X.Y.Z-rc. sections into a single X.Y.Z section). Invoke before tagging a release.
swarm-migrate
Cross-repo migration swarm — one coordinator + N parallel subagents (one per target repo) that apply the same transformation, open PRs, wait for CI, and report back to a shared JSON ledger. Coordinator handles topology, conflict auto-rebase, and stop-on-novel-failure. Use when bumping a shared dependency, rolling out…
release-management
Automates GitHub releases with semantic versioning, changelog generation from merged PRs, and gh CLI integration. Supports draft, prerelease, and standard release workflows with task-tracked multi-phase execution. Use when creating releases, tagging versions, or publishing changelogs.
release-sync
Syncs latest release content to NotebookLM and HQ Knowledge Base after version tagging. Reads CHANGELOG, CLAUDE.md, and hook README, updates notebook sources, and ingests release digest. Optionally generates podcast from updated knowledge base. Use after tagging a new version to propagate release knowledge.