New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Ship

by guardana in guardana/guardana

Commit and push a finished change the way this repo requires — explicit paths, one commit per logical change, no attribution, the five documentation places answered, the site checks before a push (a…

Apache-2.0Auto-check: notesSecurity

Install Ship

skills CLI
$ npx skills add guardana/guardana --skill ship -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install guardana/guardana ship --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/guardana/guardana.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/ship .claude/skills/ship && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
ship
GitHub stars
130
Token cost
~838 tokens
SKILL.md length
468 words
Files
1
Skills in repo
12
Repo updated
First seen
Licence
Apache-2.0

At a glance

Commit and push a finished change the way this repo requires — explicit paths, one commit per logical change, no attribution, the five documentation places answered, the site checks before a push (a…

  • Works in 5 steps: Commit → Push — a push to main deploys guardana.dev → After the push → …
  • The gate is green and the review is settled
  • SKILL.md covers 1. Commit, 2. Push — a push to main…, 3. After the push and 4. Close — one minute of retro, plus 1 more section
  • Calls git and gh

What it does

Ship is an agent skill from guardana/guardana. Commit and push a finished change the way this repo requires — explicit paths, one commit per logical change, no attribution, the five documentation places answered, the site checks before a push (a push to main deploys guardana.dev), CI watched after it, work file closed. Use when the gate is green and the review is settled.

Its SKILL.md is about 840 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Prompt injection and agent security. It works with Model Context Protocol. The repository describes itself as: Open-source AI security verification for model artifacts, live endpoints, MCP servers, and recorded agent traces. Reproducible evidence for release decisions. The licence is Apache-2.0.

When your agent uses it

  • The gate is green and the review is settled
  • Tasks that involve Prompt injection and agent security

Example prompts

  • “/ship”

Workflow steps

5 steps, taken from the step headings in SKILL.md.

  1. Commit
  2. Push — a push to main deploys guardana.dev
  3. After the push
  4. Close — one minute of retro
  5. Report

What it can do on your machine

Read from SKILL.md and the folder at commit 41f7f1b. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • git
    • gh

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use git and gh, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Ship loads about 838 tokens when it runs. Until then it costs about 83 tokens; SKILL.md has 468 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~83
When it runs · the whole SKILL.md, loaded when a task matches
~838

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:19
    not yours. Never stage an `.env*` file or anything from `.work/`.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from guardana/guardana at commit 41f7f1b, republished under its Apache-2.0 licence (© guardana). 468 words, ~838 tokens.

Download SKILL.mdSave it as .claude/skills/ship/SKILL.md (or your agent's skills folder).
name
ship
description
Commit and push a finished change the way this repo requires — explicit paths, one commit per logical change, no attribution, the five documentation places answered, the site checks before a push (a push to main deploys guardana.dev), CI watched after it, work file closed. Use when the gate is green and the review is settled.
argument-hint
[commit | push — default: both]

Ship

Tree right now:

git status --short | head -40

1. Commit

  • The full gate was green on THIS tree (/gate), verdict lines read. If something is red for a reason that is not yours, the commit message says so.
  • Stage explicit paths only — never git add . / -A; the tree may hold changes that are not yours. Never stage an .env* file or anything from .work/.
  • One commit per logical change, on main (a PR is one commit, squashed). Message in English, conventional prefix (feat|fix|refactor|docs|test|chore(scope): …), the subject says what is now true. The body carries the WHY, the measurements and the history that must not go into code comments.
  • No attribution of any kind: no Co-Authored-By, no "generated with", no session links. Check the last line of the message rather than assuming.
  • The five documentation places are answered in this same commit — CHANGELOG.md under [Unreleased] (why, not only what), FEATURES.md, the docs/ page plus docs/index.md, site/index.html for a headline claim, ROADMAP.md when the direction moved — and docs/generated/ was regenerated, never edited (/docs has the checklist).
  • M/L work: delete the work file; open leftovers as issues; move durable knowledge to its home (a docs/ page, a rule, the commit message).

2. Push — a push to main deploys guardana.dev

Cloudflare deploys site/ from the tree on every push to main, before CI has run, so a stale site/docs/ or site/llms.txt goes live. The PreToolUse hook runs the four --check scripts (generate_docs, sync_site, build_site, generate_llms_txt) before it lets the push through and refuses on drift; if it could not check, it asks. Regenerate, commit, push again.

Then git push. If the user asked only for a commit, stop before this step. A version tag is never pushed here — tags are a maintainer's release step, and the hook asks before any tag push.

Show full SKILL.md (175 more words)Show less

3. After the push

  • gh run list --limit 3, then gh run watch <id> --exit-status when you can wait. Read the failing step, not the job: a cache-cleanup step has gone red while every test step passed. Red CI is yours to fix now.
  • A change to the landing page or the docs: open the live page once it deployed (site-check with browser) and read what a visitor reads.
  • A change to what a command writes: run the documented command against a real or faked target and read the artifact. A green suite answers a narrower question than "does it work".

4. Close — one minute of retro

If a missing rule or skill line cost a detour on this task, add that ONE line now — a code trap to the matching .claude/rules/*.md, a procedure to the skill that owns it. The story behind it belongs in the commit message. Do not grow CLAUDE.md: it holds only what every session needs.

5. Report

What shipped (commit hashes), what was verified and how, what was NOT verified.

© guardana, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .claude/skills/ship of guardana/guardana.

Open the folder on GitHubat commit 41f7f1b

Compare with similar skills

Ship next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Ship compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Ship this skillguardana/guardana130—~838Automated safety check: NotesApache-2.0
Forensifyalexgreensh/repo-forensics188—~2.5kAutomated safety check: NotesCustom licence
Hol Guardhashgraph-online/hol-guard827—~542Automated safety check: PassApache-2.0
Setuphashgraph-online/hol-guard827—~443Automated safety check: PassApache-2.0
Statushashgraph-online/hol-guard827—~231Automated safety check: PassApache-2.0
Plugin Scanneriflytek/skillhub5.2k2 repos~1.1kAutomated safety check: NotesApache-2.0

Similar skills

  • Forensify

    alexgreensh/repo-forensics

    Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.

    188 GitHub stars~2.5k tokensUpdated 12 days ago
    SecurityAuto-check: notes

  • Hol Guard

    hashgraph-online/hol-guard

    Run HOL Guard scanner and guard operations via uv run hol-guard.

    827 GitHub stars~542 tokensUpdated today
    SecurityAuto-check passed

  • Setup

    hashgraph-online/hol-guard

    Install or initialize HOL Guard local runtime protection for Claude Code.

    827 GitHub stars~443 tokensUpdated today
    SecurityAuto-check passed

  • Status

    hashgraph-online/hol-guard

    Check HOL Guard local protection status for Claude Code without changing configuration.

    827 GitHub stars~231 tokensUpdated today
    SecurityAuto-check passed

  • Plugin Scanner

    iflytek/skillhub

    Scan AI agent skills, plugins, MCP servers, and agent tooling for prompt injection, unsafe commands, secret exposure, and supply-chain risks before installing or trusting them.

    5.2k GitHub starsUsed in 2 repos~1.1k tokens
    SecurityAuto-check: notes

  • Security Guide

    jnMetaCode/shellward

    OpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation

    140 GitHub stars~644 tokensUpdated 10 days ago
    SecurityAuto-check: warnings

More from guardana/guardana

All 12 skills in this repo

  • Add A Rule

    guardana/guardana

    Add security coverage to Guardana the way this repository requires — as a rule, evaluator or target, never by patching the engine — with the fixtures, the framework mapping and the documentation…

    130 GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Auto

    guardana/guardana

    Autonomous, non-interactive run of the whole lifecycle for one development task — size, plan, build, gate, review, fix, commit — without stopping for questions.

    130 GitHub stars~788 tokensUpdated today
    Auto-check passed

  • Docs

    guardana/guardana

    Documentation work in this repo — the five places a user-visible change must answer, the page conventions the site build enforces, the tests that pin prose to the registry, and a simplification pass…

    130 GitHub stars~939 tokensUpdated today
    Auto-check passed

  • False Green Audit

    guardana/guardana

    Hunt for the failure this project exists to prevent — code that compiles, types, tests green, and quietly reports "all clear" about something it never examined.

    130 GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Gate

    guardana/guardana

    Run this project's verification — the full local CI mirror (ruff, mypy, import contract, pytest with PostgreSQL, coverage floors, dogfood, generated docs and site, the isolated example suites, the…

    130 GitHub stars~757 tokensUpdated today
    Auto-check passed

  • Plan

    guardana/guardana

    Turn a development task into one work file in .work/ — goal, decisions, lanes with exact files and verification, done-criteria.

    130 GitHub stars~1k tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about Ship

What does Ship do?

Commit and push a finished change the way this repo requires — explicit paths, one commit per logical change, no attribution, the five documentation places answered, the site checks before a push (a…. Ship is an agent skill from guardana/guardana.dev), CI watched after it, work file closed.

When should I use Ship?

Ship fits situations like: the gate is green and the review is settled; tasks that involve Prompt injection and agent security.

How do I install Ship in Claude Code?

Run `npx skills add guardana/guardana --skill ship -a claude-code`. Or copy the skill folder (.claude/skills/ship in guardana/guardana) into .claude/skills/ship in your project. Claude Code loads it when a task matches its description.

How do I install Ship in Codex?

Run `npx skills add guardana/guardana --skill ship -a codex`. Or copy the skill folder (.claude/skills/ship in guardana/guardana) into .agents/skills/ship in your project. Codex loads it when a task matches its description.

Can I use Ship in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add guardana/guardana --skill ship -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/ship, .gemini/skills/ship, .github/skills/ship and .opencode/skills/ship in your project.

What does Ship need to run?

Going by SKILL.md and its folder, Ship needs the command-line tools its instructions call (git and gh).

Does Ship access the network?

SKILL.md contains no URLs. Its commands use git and gh, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Ship safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Ship use?

Ship is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Ship use?

About 838 tokens (SKILL.md is roughly 3.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Ship?

Skills that share tags, products or a category with Ship: Forensify (alexgreensh/repo-forensics, 188 stars), Hol Guard (hashgraph-online/hol-guard, 827 stars), Setup (hashgraph-online/hol-guard, 827 stars) and Status (hashgraph-online/hol-guard, 827 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Ship?

guardana (a GitHub organization) maintains it in guardana/guardana, which has 130 GitHub stars. The repository holds 12 skills in this directory. The repository was last updated on October 8, 2026.

Source: guardana/guardana on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.