Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sudais-khalid/vibe-ship --skill vibe-shipgit clone --depth 1 https://github.com/sudais-khalid/vibe-shipWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sudais-khalid/vibe-ship/vibe-ship)<a href="https://agentmods.dev/skills/sudais-khalid/vibe-ship/vibe-ship"><img src="https://agentmods.dev/badge/skills/sudais-khalid/vibe-ship/vibe-ship/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sudais-khalid/vibe-ship/vibe-ship"><img src="https://agentmods.dev/badge/skills/sudais-khalid/vibe-ship/vibe-ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00214 | $0.01741 |
| Opus 5 | $0.00107 | $0.00870 |
| Sonnet 5 | $0.00043 | $0.00348 |
| Haiku 4.5 | $0.00021 | $0.00174 |
Grade A, and why
vibe-ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 94 lines — stays where its author put it; the contents beside it link to each section on GitHub.
vibe-ship
Turns any codebase into something that can be deployed with docker compose up and shipped through CI/CD with sane, hardened defaults - all generated in one pass, tailored to the actual project. You bring the vibe; this brings the infrastructure.
Two modes
- Generate (default) - no deployment files exist yet, or the user wants a fresh setup. Walk through the workflow below.
- Audit - deployment files already exist and the user wants them reviewed/scored rather than replaced. Skip straight to "Audit an existing setup" below.
Generate: Workflow
1. Detect the stack
Look for these signal files in the project root (and one level into common subfolders like backend/, server/, api/):
| File found | Stack | Default port | Start command |
|---|---|---|---|
package.json |
Node.js | 3000 | read scripts.start |
requirements.txt / pyproject.toml |
Python | 8000 | detect Flask/FastAPI/Django |
go.mod |
Go | 8080 | go build |
pom.xml / build.gradle |
Java/Kotlin (JVM) | 8080 | detect Spring Boot / Gradle app |
Gemfile |
Ruby | 3000 | detect Rails/Sinatra |
Cargo.toml |
Rust | 8080 | cargo build --release |
composer.json |
PHP | 8000 | detect Laravel/Symfony |
If multiple signal files exist (e.g. a frontend/ and backend/ folder), treat it as a multi-service app - generate one Dockerfile per service plus a docker-compose.yml that wires them together.
If you can't confidently detect a stack, ask the user rather than guessing - a wrong Dockerfile base image is worse than no Dockerfile.
Also detect:
- Package manager (npm vs yarn vs pnpm, pip vs poetry vs uv) from lockfiles present.
- Database/cache dependencies (look for
pg,mongoose,redis,sqlalchemy, etc. in dependency files) - these become services in docker-compose.yml. - Existing
.envor.env.example- never overwrite; read it to learn what env vars the app expects. - Existing Dockerfile/CI config - if present, offer Audit mode instead of silently overwriting.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 94 lines · 214 tokens per session scan A c50f495c2ce1
vibe-ship is a skill published in the GitHub repository sudais-khalid/vibe-ship (18 stars, last pushed 1mo ago), licensed MIT. It adds 214 tokens to every session and 1,741 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dockerized-service-release-deployment-workflow
Create a Dockerized-service release contract with clean GitHub Actions builds, main-anchored tags, immutable digest manifests, published-release deployments, production approval, health checks, and exact-digest rollback.
abd-devops
ABD DevOps agent: scaffolds CI/CD, validates .env.example coverage, checks Dockerfile hygiene, and handles release tasks.
deploy-planner
Deployment and DevOps agent that generates Dockerfiles, CI/CD configs, and step-by-step deployment guides for free hosting platforms. Triggers on: deploy, launch, hosting, Docker, CI/CD, production, go live, ship it.
test-setup
Scaffold the test framework and CI/CD pipeline for the project's engine. Creates the tests/ directory structure, engine-specific test runner configuration, and GitHub Actions workflow. Run once during Technical Setup phase before the first sprint begins.
devops-deployment
Use when setting up CI/CD pipelines, containerizing applications, deploying to Kubernetes, or writing infrastructure as code. DevOps & Deployment covers GitHub Actions, Docker, Helm, and Terraform patterns.
cloudflare-sandbox
Cloudflare Sandboxes SDK for secure code execution in Linux containers at edge. Use for untrusted code, Python/Node.js scripts, AI code interpreters, git operations.