Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add wayne930242/straw-boss/plugin install straw-bossWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wayne930242/straw-boss/shipping-task)<a href="https://agentmods.dev/skills/wayne930242/straw-boss/shipping-task"><img src="https://agentmods.dev/badge/skills/wayne930242/straw-boss/shipping-task.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00124 | $0.02457 |
| Opus 5 | $0.00062 | $0.01229 |
| Sonnet 5 | $0.00025 | $0.00491 |
| Haiku 4.5 | $0.00012 | $0.00246 |
Grade A, and why
shipping-task scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Overview
See docs/roles.md for the cast of characters and the authority framework (including the merge/other-branch-push authorization gate below) this skill operates under — not redefined here.
straw-boss standardizes two lifecycle shapes across every managed app: team-mode (worktree → develop → MR → merge → archive) and solo-mode (develop directly in the app's primary checkout, commit straight to the base branch). Which one applies is how the user regards this piece of work, so Task 2 asks them — except where the resolved app's apps.json entry sets forbidDirectCommit: true, in which case only team-mode is offered. Scoping the task happens before this skill. Picking the app happens as this skill's own first step, via work-on.
The execution tier comes from boss-say: a bounded single-loop stays with the current agent; work needing a separate durable workroom uses dispatching-work. An app may already own its git lifecycle through apps.json.gitWorkflowSkill; otherwise the fallback below applies.
Commit needs no authorization — the agent commits on its own as it goes. Neither does pushing the task's own feature branch (opening or updating an MR/PR against it) — the branch was already implicitly authorized when the main agent created it; the agent reports with send-dispatch-message.py --to main --intent inform and continues, or records progress when no live route exists. Merge is the mutation the agent cannot self-authorize — as is any push that lands on another tracked branch: the agent stops and persists awaiting-authorization instead.
Task Initialization
Create durable task tracking when the selected execution tier spans turns or checkpoints. A bounded single-loop needs no extra lifecycle bookkeeping.
Task 1: Resolve the app
Invoke work-on when the target app is not established. It returns the app and directory; the execution tier remains the one selected by boss-say.
Verification: you can name the app and its directory, sourced from work-on.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed 5856109e32d5
- 6d ago First seen · 101 lines · 124 tokens per session scan A efe730973b07
shipping-task is a skill published in the GitHub repository wayne930242/straw-boss (3 stars, last pushed 2d ago), licensed MIT. It adds 124 tokens to every session and 2,457 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
push-ci
Push to remote and monitor CI. Validates branch safety, executes git push WITH explicit user approval, then monitors CI run status via gh CLI. Use when: user says 'push', 'push and watch CI', 'ship it', 'push-ci'. Not for: committing (use /smart-commit), creating PRs (use /create-pr), merging (use /merge-prep).
create-request
Create, update, or scan per-task request tickets for progress tracking. These are date-prefixed non-lifecycle docs under requests/, NOT feature-level requirements (use /req-analyze for those). Use when: tracking task progress, updating completion status, scanning incomplete requests, checking request status dashboard.…
smart-rebase
Smart partial rebase for squash-merge repositories. Auto-detect which commits to keep/drop when base branch was squash-merged into target. Use when: user says 'rebase', 'partial rebase', 'base already merged', 'smart rebase', or /smart-rebase. Not for: simple git rebase (the developer runs it — Claude never executes…
remind
Lightweight model correction with context-aware rule loading. Use when: model forgot a rule, skipped a required step, edited code/docs without running review, needs to re-read CLAUDE.md or rules. Triggers on: 'you forgot', 'remind', 'check rules', 'what did you miss', '你忘了', 'did you skip review', 'why didn't you run…
adr
Write an Architecture Decision Record (ADR) for a feature — Context / Decision / Status / Consequences / Alternatives, filed as docs/features/ /adr- - .md with a 3-digit zero-padded number. Handles the Superseded case: bidirectional linking when a new ADR replaces an old one. Use when: recording why an architectural…
claude-health
Claude Code config health check + plugin sync. Use when: auditing .claude/ structure, checking naming, verifying hook setup, detecting plugin version drift, syncing installed assets. Not for: skill quality (use skill-health-check), code review (use codex-code-review). Output: health report + fix recommendations.