Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TweekFawkes/prompts --skill shipgit clone --depth 1 https://github.com/TweekFawkes/promptsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tweekfawkes/prompts/ship)<a href="https://agentmods.dev/skills/tweekfawkes/prompts/ship"><img src="https://agentmods.dev/badge/skills/tweekfawkes/prompts/ship/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tweekfawkes/prompts/ship"><img src="https://agentmods.dev/badge/skills/tweekfawkes/prompts/ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.01478 |
| Opus 5.5 | $0.00019 | $0.00591 |
| Sonnet 5.5 | $0.00009 | $0.00296 |
| Haiku 4.5 | $0.00005 | $0.00148 |
Grade A, and why
ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ship
Ships the current branch to main. --pr-only stops after the PR is open and the Orca card is
set to in-review; without it, ship runs all the way through merge and cleanup.
1. Recon
Run in one shot: git branch --show-current, git status --short,
git log --oneline origin/main..HEAD, gh auth status, and
gh pr list --head "$(git branch --show-current)". If a PR already exists for this branch,
resume from the phase it implies instead of opening a second one.
2. Guards + secret scan
Abort with a clear message, not a partial ship, if the current branch is main, HEAD is
detached, or git log --oneline origin/main..HEAD is empty (nothing to ship).
Before anything is committed, scan for secrets in three places: the committed branch content (git diff origin/main...HEAD), the uncommitted tracked changes (git diff HEAD), and the untracked file names and content (git ls-files --others --exclude-standard | xargs grep -ilE "(api[_-]?key|secret|token|password)\s*[:=]") — grep the two diffs the same way. Also match filenames from git diff --name-only origin/main...HEAD and git ls-files --others --exclude-standard
against .env, *.pem, *.key, credentials.*, id_*, or *.backup.*. A hit is the one place a human must
decide: stop, write a blocker ticket that states exactly what matched and where, write a handoff pointing at it, and stop shipping — do not commit, push, or silently strip the file.
3. Verify
Install dependencies as CLAUDE.md says if needed, then run the test and lint commands listed in
CLAUDE.md under Commands. Both must be green. Read the Review: line of the newest
z/handoffs/*.md other than README.md. Skip the reviewer only if that line reads VERDICT GO at <sha> and git diff <sha>..HEAD --name-only lists only paths under z/ (handoff and ticket
bookkeeping); otherwise dispatch reviewer (Agent tool, base origin/main).
NO-GO path: dispatch a worker to fix the BLOCK and FIX findings, rerun the test and lint
commands, and re-review; at most three rounds. Still NO-GO after three rounds: mark the review
ticket (if any) Status: blocked with the findings, write a handoff with Review: pending at <sha>, commit it by name, leave the Orca status in-progress, and stop without pushing. This is
the one legitimate stop.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -114 lines · -87 tokens per session 12a736d53213
- 2mo ago First seen · 205 lines · 134 tokens per session scan A c7a6b8aba352
ship is a skill published in the GitHub repository TweekFawkes/prompts (2 stars, last pushed 1mo ago), licensed Unlicense. It adds 47 tokens to every session and 1,478 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
github-automation
GitHub workflow automation, PR management, issue tracking, and code review coordination. Integrates with GitHub Actions and repository management. Use when: PR creation, code review, issue management, release automation, workflow setup. Skip when: local-only changes, non-GitHub repositories.
changelog
Auto-generate a changelog from git commits and sprint data. Internal and player-facing versions.
comet-safe-delivery
A Chinese-language procedure for safely delivering specified Comet changes through Git. It covers checking worktrees and unrelated edits, staging exact files, validating hooks, and authorized commits or pushes.
close-task-commit-push-pr
Close the active backlog task (detected from branch name), commit all changes, push to remote, and open a pull request. Use when the user says "close task and ship it", "close task commit push pr", or invokes /close-task-commit-push-pr.
git-workflow
Guided git workflows: prepare PRs, clean up branches, resolve merge conflicts, handle monorepo tags, squash-and-merge patterns. Use when asked to prepare a PR, clean branches, resolve conflicts, or tag a release.
git-push
A GitHub publishing workflow that handles first-time uploads, routine updates, and tagged releases. Git is a system for recording code changes, while GitHub hosts repositories and releases online.