ship

ship is a skill for Claude Code, Codex from timurgaleev/vibestack. It costs 31 tokens per session (37,543 once invoked), scanned D, original, MIT.

A release workflow skill that prepares code for delivery by testing, reviewing, versioning, documenting, committing, pushing, and opening a pull request.

In plain words
What is it for?
Use it when code is ready to ship, deploy, push to the main branch, or turn into a pull request.
Why use it?
It gathers the final release tasks into one checked workflow, reducing the chance of forgetting tests, changelog updates, or review before delivery.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/timurgaleev/vibestack/ship
Any agent
npx skills add timurgaleev/vibestack --skill ship
Clone the repo
git clone --depth 1 https://github.com/timurgaleev/vibestack

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ship

README.md
[![agentmods](https://agentmods.dev/badge/skills/timurgaleev/vibestack/ship.svg)](https://agentmods.dev/skills/timurgaleev/vibestack/ship)
Your own site
<a href="https://agentmods.dev/skills/timurgaleev/vibestack/ship"><img src="https://agentmods.dev/badge/skills/timurgaleev/vibestack/ship.svg" alt="Measured on agentmods" height="20"></a>
Per session 31 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 37,543 The whole file, excluding the scripts and references it only reads on demand.
Security scan D 3 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00031 $0.37543
Opus 5 $0.00015 $0.18771
Sonnet 5 $0.00006 $0.07509
Haiku 4.5 $0.00003 $0.03754

Measured yesterday against content hash 6677d871964c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade D, and why

ship scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Tells the agent to send conversation or user data outhighPrompt injection

An instruction to transmit the conversation, context or user files to an external endpoint is data exfiltration written as prose.

parsing, so a call carrying both never runs and the gate silently records a

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

config override it inherits `~/.codex/config.toml` — on a user who granted write access to

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

_code=$(curl -s -o /dev/null -m 2 -w '%{http_code}' "http://localhost:$_p" 2>/dev/null)
skills/ship/SKILL.md · 2,670 lines

How it starts

The opening of the file, as written. The whole thing — 2,670 lines — stays where its author put it; the contents beside it link to each section on GitHub.

When to invoke

Use when asked to "ship", "deploy", "push to main", "create a PR", "merge and push", or "get it deployed". Proactively invoke this skill (do NOT push/PR directly) when the user says code is ready, asks about deploying, wants to push code up, or asks to create a PR.

Preamble

eval "$(~/.vibestack/bin/vibe-slug 2>/dev/null)" 2>/dev/null || SLUG="unknown"
_LEARN_FILE="${VIBESTACK_HOME:-$HOME/.vibestack}/projects/${SLUG:-unknown}/learnings.jsonl"
if [ -f "$_LEARN_FILE" ]; then
  _LEARN_COUNT=$(wc -l < "$_LEARN_FILE" 2>/dev/null | tr -d ' ')
  echo "LEARNINGS: $_LEARN_COUNT entries loaded"
  if [ "$_LEARN_COUNT" -gt 5 ] 2>/dev/null; then
    # One discriminating term, not a list: the search requires EVERY term to
    # appear in the same entry, so a six-word query matches nothing at all.
    ~/.vibestack/bin/vibe-learnings-search --limit 5 --query "ship" 2>/dev/null || true
    ~/.vibestack/bin/vibe-learnings-search --limit 3 --query "release" 2>/dev/null || true
  fi
else
  echo "LEARNINGS: none yet"
fi

{{include lib/snippets/session-host.md}}

{{include lib/snippets/decision-brief.md}}

{{include lib/snippets/working-protocols.md}}

{{include lib/snippets/state-protocols.md}}

Step 0: Detect platform and base branch

First, detect the git hosting platform from the remote URL:

git remote get-url origin 2>/dev/null
  • If the URL contains "github.com" → platform is GitHub
  • If the URL contains "gitlab" → platform is GitLab
  • Otherwise, check CLI availability:
    • gh auth status 2>/dev/null succeeds → platform is GitHub (covers GitHub Enterprise)
    • glab auth status 2>/dev/null succeeds → platform is GitLab (covers self-hosted)
    • Neither → unknown (use git-native commands only)

Determine which branch this PR/MR targets, or the repo's default branch if no PR/MR exists. Use the result as "the base branch" in all subsequent steps.

If GitHub:

  1. gh pr view --json baseRefName -q .baseRefName — if succeeds, use it
  2. gh repo view --json defaultBranchRef -q .defaultBranchRef.name — if succeeds, use it

Read the full file on GitHub · 2,670 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed · +217 lines scan A → D 6677d871964c
  2. 4d ago First seen · 2,453 lines · 31 tokens per session scan A 1a611c0e2187

Subscribe to this mod's changes

ship is a skill published in the GitHub repository timurgaleev/vibestack (6 stars, last pushed 2d ago), licensed MIT. It adds 31 tokens to every session and 37,543 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it D with 3 findings (tells the agent to send conversation or user data out, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

release-kirocc

Guide the kirocc release process step by step: create release branch, write release notes, open PR, tag, and sync GitHub Release. Use this skill whenever the user wants to release a new version, cut a release, create a tag, bump version, or says /release-kirocc. Takes a version argument like /release-kirocc v0.1.0.

d-kuro/kirocc · 87 tokens

changelog

Render release notes / a changelog from the cladding spec. Use when the user asks for release notes, a changelog, 릴리즈 노트, 변경 이력, or "what changed (since )" — run clad changelog --json for the deterministic shipped-changes manifest, then write the human-facing notes FROM it, sourcing every claim from a feature title or…

qwerfunch/cladding · 121 tokens

project-release-check

Validate this example project's release readiness. Use before publishing a release candidate.

amergrgic/kodama · 18 tokens

ship

Release engineer execution mode. Handles git operations, runs tests, creates PRs. Use when user says /ship, wants to commit and push, needs to create a PR, or is ready to land their changes.

Himanshu-Sangshetti/cursor-stack · 45 tokens

release-announcement

Write a release announcement — changelog, blog post, in-app note, or social post — that leads with user impact, names the audience, and includes upgrade/migration steps without filler.

paperclipai/paperclip · 42 tokens

multi-agent-release-manager

Cleans up the workspace, formats code, runs presubmit checks, and uploads CLs to Gerrit.

chromium/chromium · 27 tokens