Autoship

What it does

When your agent uses it

• The user needs to release a package
• Create changesets
• Automate npm publishing workflows
• Include requests to release a package

Example prompts

• “release a package”
• “create a changeset”
• “publish to npm”
• “/autoship”

Requirements

• Node.js
• A Bash shell
• A credential in AI_GATEWAY_API_KEY
• Pre-approved tools (allowed-tools): Bash(autoship:*), Bash(npx autoship:*)

Workflow steps

2 steps, taken from the first numbered list in SKILL.md.

1. 1Configure: autoship add (one-time setup)
2. 2Release: autoship (interactive) or autoship -t patch -y (automated)

What it can do on your machine

Read from SKILL.md and the folder at commit aeadbaa. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Bash(autoship:*)
  • Bash(npx autoship:*)

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships script files (Shell), which the agent can run.

  Shell commands in SKILL.md call:

  • gh
  • npx
  • changeset

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • github.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • AI_GATEWAY_API_KEY

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Autoship loads about 1.3k tokens when it runs, and up to ~3.8k if it reads all its reference files. Until then it costs about 112 tokens; SKILL.md has 292 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~112

When it runs · the whole SKILL.md, loaded when a task matches

~1.3k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~3.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from vercel-labs/autoship at commit aeadbaa, republished under its Apache-2.0 licence (© vercel-labs). 292 words, ~1,312 tokens.

name

autoship

description

CLI tool for automated changeset-based releases with AI-generated descriptions. Use when the user needs to release a package, create changesets, bump versions, or automate npm publishing workflows. Triggers include requests to "release a package", "create a changeset", "publish to npm", "bump the version", "automate releases", or any task involving version management and package publishing for repositories using the changesets workflow.

allowed-tools

Bash(autoship:*), Bash(npx autoship:*)

# GitHub CLI must be authenticated
gh auth login

# API key for AI features
export AI_GATEWAY_API_KEY="your-key"

# One-time setup: add a repository
autoship add myproject
# Prompts for: owner, repo name, base branch

# List configured repositories
autoship list

# Interactive release (prompts for type and message)
autoship myproject

# Automated release (no prompts)
autoship myproject -t patch -y
autoship myproject -t minor -y
autoship myproject -t major -y

# Release with custom message (skips AI generation)
autoship myproject -t patch -m "Fixed login bug" -y

autoship [repo]                    # Interactive repo selection if omitted
  -t, --type <type>                # Release type: patch, minor, major
  -m, --message <message>          # Custom changeset description
  -y, --yes                        # Skip all confirmations
  -h, --help                       # Show help

autoship myproject -t patch -y

autoship myproject
# 1. AI analyzes commits since last release
# 2. AI suggests release type (patch/minor/major)
# 3. You confirm or change the type
# 4. AI generates changeset description
# 5. You review and approve
# 6. Tool handles PR creation and merging

autoship myproject -t minor -m "Added new authentication providers" -y

# In GitHub Actions or CI pipeline
export AI_GATEWAY_API_KEY="${{ secrets.AI_GATEWAY_API_KEY }}"
npx autoship myproject -t patch -y

[1/10] Cloning repository from main...
  > Repository cloned
  > Package: my-package @ 1.2.3

[2/10] Creating release branch...
  > Branch created: release/patch-1706123456789

[3/10] Generating changeset...
  > Changeset created: fluffy-pants-dance.md

...

Release Complete!
The patch release has been published.

{
  "repos": {
    "myproject": {
      "owner": "vercel-labs",
      "repo": "myproject",
      "baseBranch": "main",
      "cloneUrl": "https://github.com/vercel-labs/myproject.git"
    }
  }
}

./templates/automated-release.sh myproject patch
./templates/setup-repo.sh myproject vercel-labs myproject main

© vercel-labs, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 5 other files (references) in skills/autoship of vercel-labs/autoship.

• SKILL.md
• references/ci-integration.md
• references/commands.md
• references/configuration.md
• templates/automated-release.sh
• templates/setup-repo.sh

Open the folder on GitHubat commit aeadbaa