ship

ship is a skill for Claude Code, Codex from Snowflake-Labs/cocoplus. It costs 41 tokens per session (2,225 once invoked), scanned A, original, MIT.

A release workflow that checks approved project documents, creates a structured Git commit, adds a version tag, and can open a pull request. It also records deployment details.

In plain words
What is it for?
Use it to prepare an approved project for release, create its Git version marker, optionally open a pull request, and record deployment information.
Why use it?
It prevents shipping before the required review and project files are approved. It keeps the release steps and deployment record together.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/snowflake-labs/cocoplus/ship
Any agent
npx skills add Snowflake-Labs/cocoplus --skill ship
Clone the repo
git clone --depth 1 https://github.com/Snowflake-Labs/cocoplus

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ship

README.md
[![agentmods](https://agentmods.dev/badge/skills/snowflake-labs/cocoplus/ship.svg)](https://agentmods.dev/skills/snowflake-labs/cocoplus/ship)
Your own site
<a href="https://agentmods.dev/skills/snowflake-labs/cocoplus/ship"><img src="https://agentmods.dev/badge/skills/snowflake-labs/cocoplus/ship.svg" alt="Measured on agentmods" height="20"></a>
Per session 41 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,225 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00041 $0.02225
Opus 5 $0.00020 $0.01112
Sonnet 5 $0.00008 $0.00445
Haiku 4.5 $0.00004 $0.00222

Measured yesterday against content hash 485f3e7392bb, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

ship scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

const { spawnSync } = require('child_process');
.cortex/skills/cocobrew/ship.skill.md · 194 lines

How it starts

The opening of the file, as written. The whole thing — 194 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are executing the Ship phase (6/6) of CocoBrew.

Before proceeding, verify that .cocoplus/ exists. If not: output "CocoPlus not initialized in this directory. Run $pod init to begin." Then stop.

Read .cocoplus/lifecycle/meta.json. Verify phases_completed contains "review". If not: output "The Review phase must be approved before shipping. Run $review first." Then stop.

Verify that required lifecycle artifact files exist on disk — meta.json alone is not sufficient:

  • Check .cocoplus/lifecycle/spec.md exists. If not: output "spec.md is missing. Run $spec to regenerate it before shipping." Then stop.
  • Check .cocoplus/lifecycle/plan.md exists. If not: output "plan.md is missing. Run $plan to regenerate it before shipping." Then stop.
  • Check .cocoplus/lifecycle/review.md exists. If not: output "review.md is missing. Run $review to regenerate it before shipping." Then stop.

Read .cocoplus/lifecycle/review.md. Verify ## Approval Status contains APPROVED. If not: output "Review has not been approved. Run $review to complete the approval process." Then stop.

Read .cocoplus/lifecycle/review-state.json if it exists. If any finding has severity: BLOCKED and resolved is not true: Output: "Ship blocked: [N] unresolved BLOCKED finding(s) require a human decision before shipping. Run $review clear-blocked --id <finding-id> --rationale <text> to resolve each one." List each unresolved finding's ID and one-line summary. Then stop. BLOCKED findings are treated identically to BLOCKING findings — there is no override.

Determine Version

First inspect the current git branch and look for a semantic version token:

node -e "
const { spawnSync } = require('child_process');
const branch = spawnSync('git', ['branch', '--show-current'], { encoding: 'utf8' }).stdout.trim();
const match = branch.match(/(?:^|[^0-9])v?(\d+\.\d+\.\d+)(?:$|[^0-9])/);
console.log(JSON.stringify({ branch, version: match ? 'v' + match[1] : null }));
"

If the branch contains a version, normalize it to v<major>.<minor>.<patch> and use that as the release version unless the developer explicitly overrides it. Examples: feature/cocoplus-v1.2.0 and release/1.2.0 both resolve to v1.2.0.

If the branch does not contain a version, do not infer or auto-increment one. Prompt:

"The current git branch does not include a semantic version. What semantic version should this release be? (e.g., v1.2.0)"

Validate the developer's answer matches v<major>.<minor>.<patch> exactly. If it does not, re-prompt once. Use the developer's answer as the version.

Use existing tags only as context for the prompt:

node -e "
const { spawnSync } = require('child_process');
const tags = spawnSync('git', ['tag', '--list'], { encoding: 'utf8' }).stdout.trim().split(/\r?\n/).filter(Boolean);
const semver = tags.map(t => {
  const m = t.match(/^v?(\d+)\.(\d+)\.(\d+)$/);
  return m ? { tag: 'v' + m.slice(1).join('.'), nums: m.slice(1).map(Number) } : null;
}).filter(Boolean);
semver.sort((a,b)=>{ for(let i=0;i<3;i++){ if(a.nums[i]!==b.nums[i]) return b.nums[i]-a.nums[i]; } return 0; });
console.log(semver[0]?.tag || 'none');
"

When updating CHANGELOG.md, use the branch-derived release version. If that version already exists, append the new release notes under that version. If the version exists but the current month does not, create a new month subsection under that same version. If the branch has no version, ask for the version before editing the changelog.

Read the full file on GitHub · 194 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 194 lines · 41 tokens per session scan A 485f3e7392bb

Subscribe to this mod's changes

ship is a skill published in the GitHub repository Snowflake-Labs/cocoplus (720 stars, last pushed 2d ago), licensed MIT. It adds 41 tokens to every session and 2,225 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

release-validation

Use this skill when validating a MeshLLM release candidate or current HEAD against the last GitHub release, assembling the canonical feature/fix/modification inventory, testing locally built release bundles on user-approved real hosts and private meshes, deciding release readiness, or producing a formal…

Mesh-LLM/mesh-llm · 62 tokens

changelog

Turn a range of commits or merged PRs into a changelog entry grouped by change type. Use when the user asks for release notes, a changelog, or "what changed" between two points.

omnigent-ai/omnigent · 44 tokens

changelog

Update per-package CHANGELOG.md files for a Ratel release. Drafts entries with git-cliff (scoped per package), lets you curate, then writes the CHANGELOGs. Handles both RC entries and GA-graduation collapse (merging X.Y.Z-rc. sections into a single X.Y.Z section). Invoke before tagging a release.

ratel-ai/ratel · 74 tokens

swarm-migrate

Cross-repo migration swarm — one coordinator + N parallel subagents (one per target repo) that apply the same transformation, open PRs, wait for CI, and report back to a shared JSON ledger. Coordinator handles topology, conflict auto-rebase, and stop-on-novel-failure. Use when bumping a shared dependency, rolling out…

yonatangross/orchestkit · 103 tokens

release-management

Automates GitHub releases with semantic versioning, changelog generation from merged PRs, and gh CLI integration. Supports draft, prerelease, and standard release workflows with task-tracked multi-phase execution. Use when creating releases, tagging versions, or publishing changelogs.

yonatangross/orchestkit · 58 tokens

release-sync

Syncs latest release content to NotebookLM and HQ Knowledge Base after version tagging. Reads CHANGELOG, CLAUDE.md, and hook README, updates notebook sources, and ingests release digest. Optionally generates podcast from updated knowledge base. Use after tagging a new version to propagate release knowledge.

yonatangross/orchestkit · 62 tokens