fix-and-ship — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fix-and-ship (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an autonomous emergency fix-and-deploy agent. Do NOT ask the user questions. Speed matters — this is an incident response pipeline.
INPUT: $ARGUMENTS Pass the bug description, error message, stack trace, or area that's broken.
============================================================ PHASE 0: INCIDENT TIMELINE — START CLOCK ============================================================
Record the incident start time:
echo "INCIDENT_START=$(date -u +%Y-%m-%dT%H:%M:%SZ)" > /tmp/fix-and-ship-timelineGather context for the timeline:
============================================================ PHASE 1: HOTFIX ============================================================
Follow the instructions defined in the /hotfix skill. Pass the input arguments to the hotfix skill.
The hotfix skill will:
Commit suffix detection: Check the project for deploy conventions:
git log --oneline -20 for patterns like deploy:*, [deploy], [skip ci].github/workflows/, vercel.json, fly.toml, railway.json, Procfile, Dockerfile)If the hotfix skill reports failure (couldn't fix in 2 iterations), go to PHASE 5: ROLLBACK STRATEGY. Do NOT proceed to deploy.
Record fix completion:
echo "FIX_COMPLETE=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> /tmp/fix-and-ship-timeline============================================================ PHASE 2: PREFLIGHT ============================================================
Follow the instructions defined in the /preflight skill.
The preflight skill will verify:
If preflight reports NOT READY:
============================================================ PHASE 3: DEPLOY ============================================================
Auto-detect the deployment target and deploy:
Detection order:
vercel.json or .vercel/ → Vercel: vercel --prodfly.toml → Fly.io: fly deployrailway.json or railway.toml → Railway: railway upProcfile + app.json → Heroku: git push heroku HEAD:maink8s/ or kubernetes/ or kustomization.yaml or **/deployment.yaml → Kubernetes: kubectl apply -k . or kubectl rollout restart deployment/{app}serverless.yml → Serverless Framework: npx serverless deploycdk.json or template.yaml (SAM) → AWS: cdk deploy or sam deploy.github/workflows/ with deploy job → GitHub Actions: deployment is automatic on merge — just merge the PR: gh pr merge --squashIf the deploy command fails:
Record deploy completion:
echo "DEPLOY_COMPLETE=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> /tmp/fix-and-ship-timeline============================================================ PHASE 4: DEPLOYMENT VERIFICATION ============================================================
Verify the service is healthy after deploying. Use what is available:
variables, or deployment output. Common patterns:
/health, /healthz, /api/health, /_health, /statusfly.toml ([http_service]), vercel.json (rewrites), Kubernetes readiness probescurl -sf {url}/health — expect 200vercel inspect or check deployment URL from deploy outputfly status and fly checks listrailway statusheroku ps and heroku logs --tail -n 50kubectl rollout status deployment/{app} and kubectl get podscurl -sf {url} — expect 2xx responsefly logs -n 20heroku logs -n 20kubectl logs deployment/{app} --tail=20If verification fails:
Record verification:
echo "VERIFIED=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> /tmp/fix-and-ship-timeline============================================================ PHASE 5: ROLLBACK STRATEGY (only if something failed) ============================================================
This phase is entered when:
Rollback actions by failure point:
A) Fix failed (couldn't diagnose/fix in 2 iterations):
git stash or git checkout -- . to clean up partial changesB) Deploy failed:
fly releases then fly deploy --image {previous-image}heroku rollbackkubectl rollout undo deployment/{app}git revert HEAD && git pushC) Verification failed (deployed but unhealthy):
============================================================ PHASE 6: NOTIFICATION (optional) ============================================================
Check if the project has notification hooks configured:
SLACK_WEBHOOK_URL in .env, .env.local, or CI configcurl -X POST -H 'Content-Type: application/json' -d '{"text":"..."}' $SLACK_WEBHOOK_URLgh issue comment {number} --body "..."gh issue close {number}Notification payload (adapt to format):
============================================================ SELF-HEALING VALIDATION (max 3 iterations) ============================================================
After completing all phases, validate the combined output:
STOP when:
IF STILL FAILING after 3 iterations:
============================================================ OUTPUT ============================================================
| Event | Timestamp (UTC) |
|---|---|
| Reported | {timestamp or "this session"} |
| Fix applied | {timestamp} |
| Tests verified | {timestamp} |
| Deployed | {timestamp or "N/A — manual deploy"} |
| Verified healthy | {timestamp or "N/A"} |
| MTTR | {minutes}m |
{If SHIPPED: "Fix deployed and verified healthy."} {If DEPLOYED BUT UNHEALTHY: "Deployed but health check failed. Rolled back to previous version. Investigate further."} {If ROLLED BACK: "Deployment failed. Rolled back. Previous version is serving."} {If BLOCKED: "Fix or preflight failed. See details above. No deployment attempted."}
============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /fix-and-ship — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.