Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/timurgaleev/vibestack/shipnpx skills add timurgaleev/vibestack --skill shipgit clone --depth 1 https://github.com/timurgaleev/vibestackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/timurgaleev/vibestack/ship)<a href="https://agentmods.dev/skills/timurgaleev/vibestack/ship"><img src="https://agentmods.dev/badge/skills/timurgaleev/vibestack/ship.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00031 | $0.37543 |
| Opus 5 | $0.00015 | $0.18771 |
| Sonnet 5 | $0.00006 | $0.07509 |
| Haiku 4.5 | $0.00003 | $0.03754 |
Grade D, and why
ship scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent to send conversation or user data outhighPrompt injection
An instruction to transmit the conversation, context or user files to an external endpoint is data exfiltration written as prose.
parsing, so a call carrying both never runs and the gate silently records a Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
config override it inherits `~/.codex/config.toml` — on a user who granted write access to Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
_code=$(curl -s -o /dev/null -m 2 -w '%{http_code}' "http://localhost:$_p" 2>/dev/null) How it starts
The opening of the file, as written. The whole thing — 2,670 lines — stays where its author put it; the contents beside it link to each section on GitHub.
When to invoke
Use when asked to "ship", "deploy", "push to main", "create a PR", "merge and push", or "get it deployed". Proactively invoke this skill (do NOT push/PR directly) when the user says code is ready, asks about deploying, wants to push code up, or asks to create a PR.
Preamble
eval "$(~/.vibestack/bin/vibe-slug 2>/dev/null)" 2>/dev/null || SLUG="unknown"
_LEARN_FILE="${VIBESTACK_HOME:-$HOME/.vibestack}/projects/${SLUG:-unknown}/learnings.jsonl"
if [ -f "$_LEARN_FILE" ]; then
_LEARN_COUNT=$(wc -l < "$_LEARN_FILE" 2>/dev/null | tr -d ' ')
echo "LEARNINGS: $_LEARN_COUNT entries loaded"
if [ "$_LEARN_COUNT" -gt 5 ] 2>/dev/null; then
# One discriminating term, not a list: the search requires EVERY term to
# appear in the same entry, so a six-word query matches nothing at all.
~/.vibestack/bin/vibe-learnings-search --limit 5 --query "ship" 2>/dev/null || true
~/.vibestack/bin/vibe-learnings-search --limit 3 --query "release" 2>/dev/null || true
fi
else
echo "LEARNINGS: none yet"
fi
{{include lib/snippets/session-host.md}}
{{include lib/snippets/decision-brief.md}}
{{include lib/snippets/working-protocols.md}}
{{include lib/snippets/state-protocols.md}}
Step 0: Detect platform and base branch
First, detect the git hosting platform from the remote URL:
git remote get-url origin 2>/dev/null
- If the URL contains "github.com" → platform is GitHub
- If the URL contains "gitlab" → platform is GitLab
- Otherwise, check CLI availability:
gh auth status 2>/dev/nullsucceeds → platform is GitHub (covers GitHub Enterprise)glab auth status 2>/dev/nullsucceeds → platform is GitLab (covers self-hosted)- Neither → unknown (use git-native commands only)
Determine which branch this PR/MR targets, or the repo's default branch if no PR/MR exists. Use the result as "the base branch" in all subsequent steps.
If GitHub:
gh pr view --json baseRefName -q .baseRefName— if succeeds, use itgh repo view --json defaultBranchRef -q .defaultBranchRef.name— if succeeds, use it
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +217 lines scan A → D 6677d871964c
- 4d ago First seen · 2,453 lines · 31 tokens per session scan A 1a611c0e2187
ship is a skill published in the GitHub repository timurgaleev/vibestack (6 stars, last pushed 2d ago), licensed MIT. It adds 31 tokens to every session and 37,543 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it D with 3 findings (tells the agent to send conversation or user data out, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
release-kirocc
Guide the kirocc release process step by step: create release branch, write release notes, open PR, tag, and sync GitHub Release. Use this skill whenever the user wants to release a new version, cut a release, create a tag, bump version, or says /release-kirocc. Takes a version argument like /release-kirocc v0.1.0.
changelog
Render release notes / a changelog from the cladding spec. Use when the user asks for release notes, a changelog, 릴리즈 노트, 변경 이력, or "what changed (since )" — run clad changelog --json for the deterministic shipped-changes manifest, then write the human-facing notes FROM it, sourcing every claim from a feature title or…
project-release-check
Validate this example project's release readiness. Use before publishing a release candidate.
ship
Release engineer execution mode. Handles git operations, runs tests, creates PRs. Use when user says /ship, wants to commit and push, needs to create a PR, or is ready to land their changes.
release-announcement
Write a release announcement — changelog, blog post, in-app note, or social post — that leads with user impact, names the audience, and includes upgrade/migration steps without filler.
multi-agent-release-manager
Cleans up the workspace, formats code, runs presubmit checks, and uploads CLs to Gerrit.