ops-ship — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ops-ship (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The whole release chain in a single shot:
branch (default main), overriding required checks/reviews (gh pr merge --admin). A failed merge aborts before the release — no partial ship.
bin/ops-release: bump plugin.json +marketplace.json registry + package.json + CHANGELOG, open the release PR, admin-merge to main, tag vX.Y.Z.
ops-update to pull the new version onto thisbox (skip with --no-update).
ops-ship= sweep +/ops:ops-release+/ops:ops-updatein one. For just the publish step use/ops:ops-release; for just the pull step use/ops:ops-update.
By design the sweep is aggressive: it admin-merges all open non-draft PRs on the base branch, bypassing required checks (red CI, missing reviews) — exactly what you want for a trusted solo/own-org repo, dangerous if an unrelated or half-baked PR is open. So always dry-run first and show which PRs it will merge before applying (Rule 5 — bulk merge + outward-facing release + tag is high-impact and hard to reverse). It only skips drafts.
Like ops-release, ops-ship resolves its targets relative to its own path and needs REPO_ROOT/.claude-plugin/marketplace.json, which the plugin cache lacks. Run the copy inside a git checkout of the repo:
SHIP=""
for d in ~/Projects/claude-ops-workspace/claude-ops ~/Projects/claude-ops/claude-ops "$HOME"/Projects/*/claude-ops; do
if [ -f "$d/.claude-plugin/marketplace.json" ] && [ -x "$d/claude-ops/bin/ops-ship" ]; then
SHIP="$d/claude-ops/bin/ops-ship"; break
fi
done
[ -n "$SHIP" ] || { echo "no claude-ops checkout with marketplace.json found"; exit 1; }"$SHIP" --type patch --dry-runPresent: the list of open PRs it will admin-merge, the version bump (current → new), the manifests touched, and the CHANGELOG block. (--notes defaults to a bullet list of the merged PR titles; pass --notes "…" to override.)
Use AskUserQuestion before applying (this merges PRs AND publishes):
Ship: admin-merge N open PR(s) on main, then release <CUR> → <NEW> + tag?
[Ship it]
[Dry-run only]
[Cancel]"$SHIP" --type patch # or --version X.Y.Z, --notes "…", --no-updateStream the step output (sweep → release → update). On success it ends with the new tag and the reload reminder. Surface the final line verbatim:
Restart Claude Code (or run `/reload-plugins`) to load v<NEW>.
| Flag | Effect | ||
|---|---|---|---|
| `--type patch\ | minor\ | major` | Semver bump for the release (default patch). |
--version X.Y.Z | Exact target version instead of bumping. | ||
--notes "…" | CHANGELOG body. Defaults to a bullet list of the merged PR titles. | ||
--base BRANCH | Base branch for the PR sweep only (must be main; ops-release always publishes to main). | ||
--no-update | Don't run ops-update afterwards (publish only). | ||
--dry-run | Report only — list PRs + the bump, change nothing. Always run this first. |
--admin (own-org PRs can't beself-approved; admin bypasses the review/required-check gates).
ops-release use gh (GitHub REST). If REST isexhausted (HTTP 403 rate-limit), wait for the reset window — ops-ship aborts before releasing if any merge fails rather than partial-shipping.
ops-update (pull, run automatically unless --no-update) and /reload-plugins (load).
/ops:ops-release (publish only), /ops:ops-update (pull only).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.