Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sudais-khalid/vibe-ship --skill vibe-shipgit clone --depth 1 https://github.com/sudais-khalid/vibe-shipWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sudais-khalid/vibe-ship/vibe-ship)<a href="https://agentmods.dev/skills/sudais-khalid/vibe-ship/vibe-ship"><img src="https://agentmods.dev/badge/skills/sudais-khalid/vibe-ship/vibe-ship/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sudais-khalid/vibe-ship/vibe-ship"><img src="https://agentmods.dev/badge/skills/sudais-khalid/vibe-ship/vibe-ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00254 | $0.03022 |
| Opus 5.5 | $0.00102 | $0.01209 |
| Sonnet 5.5 | $0.00051 | $0.00604 |
| Haiku 4.5 | $0.00025 | $0.00302 |
Grade A, and why
vibe-ship scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Then climb `references/verification.md` as far as the environment allows: `docker compose config`, `docker build`, `docker compose up --wait`, curl the health path, check the UID, and clean up. In an interactive session, How it starts
The opening of the file, as written. The whole thing — 178 lines — stays where its author put it; the contents beside it link to each section on GitHub.
vibe-ship
Turns any codebase into something you can ship: hardened containers, a wired-up stack, a CI/CD pipeline, and the target platform's config. Every claim is backed by detection output, the audit score, and (when Docker is available) a real build and health check.
Scripts live in this skill's scripts/ directory. They are standard-library Python 3.8+ with no installs. Invoke them as python3 <skill-dir>/scripts/<name>.py, or with python / py -3 on Windows.
| Script | Purpose |
|---|---|
detect.py --path <repo> --json |
Evidence: services, stack, versions, ports, entrypoints, backing services, env vars, existing deploy files |
audit.py --path <repo> |
90+ rules across Dockerfile, .dockerignore, Compose, GitHub Actions, GitLab CI, Kubernetes. Score, grade, --format sarif|json|markdown, --fail-on high |
pin_actions.py .github/workflows |
Pins every uses: to a commit SHA (# vX.Y.Z comment kept) via git ls-remote |
Pick the mode
| The user wants... | Mode |
|---|---|
| deployment files that don't exist yet | Generate |
| an opinion on existing files ("review", "audit", "is this secure", "score my Dockerfile") | Audit |
| existing files improved ("fix", "harden", "make this production-ready" when files exist) | Fix (Audit, then apply) |
| to go live on a specific platform | Target (Generate or reuse the image, then add the platform layer) |
If detect.py reports existing Dockerfile/compose/CI and the user didn't explicitly ask to regenerate, use Audit or Fix. Never overwrite an existing deployment file without saying so first.
Generate
1. Detect (evidence, not guesses)
python3 <skill-dir>/scripts/detect.py --path . --json
Read the result before anything else:
services[]are what gets a Dockerfile.packages[]are libraries and workspace roots that don't.- Per service:
language,framework,kind(web/worker/static),package_manager+lockfile,runtime_version+version_source,port,entrypoint,build_cmd,health_path,backing_services,workers,migrations,env_vars,notes. monorepo: build with the repo root as context.existing: deployment files already present.git.image_refis the GHCR image name.warnings: each one becomes either a question to the user or a DEPLOYMENT.md item.
What ships with it
25 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/anti-patterns.md 3.1 KB
- references/audit-rules.md 14 KB
- references/cicd-patterns.md 12 KB
- references/deploy-targets.md 9.4 KB
- references/kubernetes.md 8.3 KB
- references/scalability-checklist.md 2.8 KB
- references/security-checklist.md 3.6 KB
- references/servers.md 6.3 KB
- references/services.md 7.6 KB
- references/stacks/dotnet.md 2.7 KB
- references/stacks/elixir.md 3.2 KB
- references/stacks/go.md 3.1 KB
- references/stacks/jvm.md 5.6 KB
- references/stacks/node.md 9.2 KB
- references/stacks/other.md 3.8 KB
- references/stacks/php.md 5.0 KB
- references/stacks/python.md 7.0 KB
- references/stacks/ruby.md 4.2 KB
- references/stacks/rust.md 3.1 KB
- references/stacks/static.md 5.1 KB
- references/verification.md 2.6 KB
- references/versions.md 5.1 KB
- scripts/audit.py 82 KB runs code
- scripts/detect.py 64 KB runs code
- scripts/pin_actions.py 5.6 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +84 lines · +40 tokens per session 250916339fb3
- 1mo ago First seen · 94 lines · 214 tokens per session scan A c50f495c2ce1
vibe-ship is a skill published in the GitHub repository sudais-khalid/vibe-ship (18 stars, last pushed 5d ago), licensed MIT. It adds 254 tokens to every session and 3,022 once invoked, about $0.0010 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
abd-devops
ABD DevOps agent: scaffolds CI/CD, validates .env.example coverage, checks Dockerfile hygiene, and handles release tasks.
dockerized-service-release-deployment-workflow
Create a Dockerized-service release contract with clean GitHub Actions builds, main-anchored tags, immutable digest manifests, published-release deployments, production approval, health checks, and exact-digest rollback.
deploy-planner
Deployment and DevOps agent that generates Dockerfiles, CI/CD configs, and step-by-step deployment guides for free hosting platforms. Triggers on: deploy, launch, hosting, Docker, CI/CD, production, go live, ship it.
test-setup
Scaffold the test framework and CI/CD pipeline for the project's engine. Creates the tests/ directory structure, engine-specific test runner configuration, and GitHub Actions workflow. Run once during Technical Setup phase before the first sprint begins.
devops-deployment
Use when setting up CI/CD pipelines, containerizing applications, deploying to Kubernetes, or writing infrastructure as code. DevOps & Deployment covers GitHub Actions, Docker, Helm, and Terraform patterns.
cloudflare-sandbox
Cloudflare Sandboxes SDK for secure code execution in Linux containers at edge. Use for untrusted code, Python/Node.js scripts, AI code interpreters, git operations.