What is before-you-ship?

A pre-deployment checklist that tests whether a web project is ready to publish. It checks pages, forms, sign-in, mobile layouts, and other release concerns.

Use it before deployment to check routes, forms, authentication, mobile behavior, and the other checks included in the release checklist.

It finds problems that may not be obvious from looking at a page, such as failed form submissions, broken protected-page redirects, or layouts that overflow on phones.

before-you-ship — Skill for Claude Code and Codex by sso-ss

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add sso-ss/vibe-ship-it --skill before-you-ship

Clone the repo

git clone --depth 1 https://github.com/sso-ss/vibe-ship-it

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/sso-ss/vibe-ship-it/before-you-ship/github.svg)](https://agentmods.dev/skills/sso-ss/vibe-ship-it/before-you-ship)

Your own site

<a href="https://agentmods.dev/skills/sso-ss/vibe-ship-it/before-you-ship"><img src="https://agentmods.dev/badge/skills/sso-ss/vibe-ship-it/before-you-ship/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/sso-ss/vibe-ship-it/before-you-ship"><img src="https://agentmods.dev/badge/skills/sso-ss/vibe-ship-it/before-you-ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 51 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,219 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00051	$0.01219
Opus 5.5	$0.00020	$0.00488
Sonnet 5.5	$0.00010	$0.00244
Haiku 4.5	$0.00005	$0.00122

Measured 2mo ago against content hash 42c341fc36a0, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

before-you-ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/before-you-ship/SKILL.md · 144 lines

How it starts

The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Before You Ship

The full 9-item checklist that runs before deployment. Called automatically by the shipper agent. Can also be triggered manually.

The 9 Checks

1. All Pages Load

Visit every route in the app. Each must render without:

Console errors
Blank pages
Uncaught exceptions
Missing components

2. Forms Save Correctly

Submit every form with test data. Verify:

Data appears in Supabase (or whatever storage is used)
Success confirmation shows
Form clears or redirects after submit
Submit button shows loading state (prevents double-submit)

3. Auth Works (if present)

If the project has login:

Visit a protected page while logged out → should redirect to login
Log in with valid credentials → should reach the protected page
Sign out → should return to public page
Visit login while already logged in → should redirect to dashboard

Skip if no auth is set up.

4. Mobile Layout

Check at 375px (phone) and 768px (tablet):

No horizontal overflow
Text readable without zooming
Navigation usable (hamburger, bottom nav, or responsive links)
Forms fillable (inputs not cut off, keyboard doesn't hide submit button)
Images scale properly

5. Images Load

No broken image icons
All images have reasonable file sizes (warn if any > 1MB)
All <img> tags have alt attributes (even if empty string for decorative images)

6. No Dead Links

Click every link on every page
No 404 pages
No links that go nowhere or point to #
External links open in new tab

7. Accessibility Basics

Not a full WCAG audit — just the essentials:

All images have alt text
All interactive elements (inputs, buttons, icon links) have visible labels or aria-label
Color contrast meets WCAG AA minimum (4.5:1 for text, 3:1 for large text)
Focus indicators visible when tabbing through the page
Page has a <title> tag

8. Page Speed

Run a basic performance check:

Page loads in under 3 seconds
No massive unoptimized images
No blocking scripts
Fonts load without visible flash

Read the full file on GitHub · 144 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 144 lines · 51 tokens per session scan A 42c341fc36a0

Subscribe to this mod's changes

before-you-ship is a skill published in the GitHub repository sso-ss/vibe-ship-it (12 stars, last pushed 6mo ago), licensed MIT. It adds 51 tokens to every session and 1,219 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

CI and CD DevOps and cloud E2E testing Testing

e2e-testing

Use when reviewing CI coverage, automated checks, or test strategy related to Implement end-to-end testing. Focus on whether the rule is continuously verified, not just documented.

thedaviddias/Front-End-Checklist · 38 tokens

azure-microsoft-playwright-testing-ts

Run Playwright tests at scale using Azure Playwright Workspaces (formerly Microsoft Playwright Testing). Use when scaling browser tests across cloud-hosted browsers, integrating with CI/CD pipelines, or publishing test results to the Azure portal.

microsoft/skills · 53 tokens

mirrord-chaos

Help users chaos test their app with mirrord: inject artificial latency or connection errors into a mirrord session's outgoing traffic via per-session chaos rules managed with the mirrord chaos CLI. Use when a user wants to add latency or delay to outgoing connections or a dependency (e.g. a slow database), simulate…

metalbear-co/mirrord · 119 tokens

before-you-ship