Runs a pre-ship security scan to detect secrets, vulnerabilities, and risky code patterns.
Install
mkdir -p .claude/skills/ship-safe && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/11980" && unzip -o skill.zip -d .claude/skills/ship-safe && rm skill.zipInstalls to .claude/skills/ship-safe
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Run ship-safe security and quality audit on the current project. Executes npx ship-safe audit . and reports findings by severity. Use before shipping any feature or PR.Key capabilities
- →Run ship-safe security audit
- →Run ship-safe quality audit
- →Check for secrets
- →Check for vulnerabilities
- →Check for risky patterns
- →Report findings by severity
How it works
This skill executes the `npx ship-safe audit .` command from the project root to scan for security and quality issues. It then parses the output and reports findings categorized by severity.
Inputs & outputs
When to use ship-safe
- →Security audit before a PR
- →Checking for hardcoded secrets
- →Verifying code quality before shipping
- →Auditing dependencies for vulnerabilities
About this skill
SKILL: Ship-Safe Audit
What It Does
Runs ship-safe — a pre-ship security and quality scanner that checks for secrets, vulnerabilities, and risky patterns before code reaches production.
Usage
npx ship-safe audit .
Run from the project root. No install required (npx fetches it on demand).
Opt-In
Ship-safe is disabled by default. To enable it:
- CI/CD: set the repository variable
ENABLE_SHIP_SAFE=truein GitHub → Settings → Variables - Agents / local: set env var
ENABLE_SHIP_SAFE=truebefore invoking/ship-safe
When to Use
Only run if ENABLE_SHIP_SAFE=true is set. When enabled, appropriate moments are:
- Before opening a PR
- After adding new dependencies
- Before merging any feature branch to main
- After touching auth, secrets handling, or infra config
Output Interpretation
| Symbol / keyword | Severity | Action |
|---|---|---|
✓ PASS / ok / no issues | Clean | Safe to ship |
⚠ WARN / MEDIUM / LOW | Advisory | Review before shipping |
✗ FAIL / ERROR / CRITICAL / HIGH | Blocker | Must fix before shipping |
Agent Instructions
- Run
npx ship-safe audit .from the repo root. - Parse stdout for CRITICAL/HIGH findings — these are blockers.
- For each blocker: report the file, line, and finding description.
- For MEDIUM/LOW: report as advisory, do not block.
- If all checks pass: confirm "ship-safe: clean" and proceed.
- If blockers found: halt the task, report findings to Orchestrator.
Example Integration (architect / pre-ship checklist)
/ship-safe
The skill runs the audit, colors findings by severity, and surfaces blockers before any merge action.
When not to use it
- →When `ENABLE_SHIP_SAFE=true` is not set
Limitations
- →Only runs if `ENABLE_SHIP_SAFE=true` is set
- →Requires `npx` to fetch ship-safe on demand
How it compares
This skill automates the execution and interpretation of a pre-ship security scanner, providing categorized findings directly, rather than requiring manual execution and analysis of the tool's output.
Compared to similar skills
ship-safe side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| ship-safe (this skill) | 0 | 1mo | Review | Beginner |
| verifier | 0 | 2mo | Caution | Intermediate |
| dependency-auditor | 1 | 9mo | Review | Beginner |
| security-scanning-security-dependencies | 1 | 4mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
verifier
oleyna80
Pre-merge quality gate. Use to verify code is ready to ship: route contracts (status, Content-Type, body), TypeScript, tests, CSP/CSRF headers, schema alignment, secret leak scan. Issues structured READY or BLOCKED verdict with file:line evidence. Read-only. Для верификации, проверки перед мержем, и
dependency-auditor
alirezarezvani
Check dependencies for known vulnerabilities using npm audit, pip-audit, etc. Use when package.json or requirements.txt changes, or before deployments. Alerts on vulnerable dependencies. Triggers on dependency file changes, deployment prep, security mentions.
security-scanning-security-dependencies
sickn33
You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across ecosystems to identify vulnerabilities, assess risks, and recommend remediation.
dependency-management-deps-audit
sickn33
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.
repo-security-posture
superagent-ai
Audit a GitHub repository's security posture and hardening gaps across branch protection, CODEOWNERS, GitHub Actions, publish/release integrity, collaborator access, security features, and dependency review. Use when reviewing or hardening a repo, assessing GitHub configuration, checking CI/CD or Ac
ai-security
arcasilesgroup
Runs security gates: SAST with OWASP/CWE mapping, dependency vulnerability scans, secret detection, SBOM generation for compliance, pre-release security verdict. Trigger for 'is this secure', 'audit dependencies', 'check for secrets', 'security report', 'is this package safe', 'compliance review'. N