Is ship-mini safe to install?

SaferSkills independently audited ship-mini (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/ship-mini/SKILL.md · 1 file

skills/ship-mini/SKILL.md2.0 KB · Markdown

name: ship-mini

description: Run a lightweight GO or NO-GO gate before use, especially for autonomous or scheduled workflows.

Ship Mini

Purpose

Decide whether a small project, dashboard, ML workflow, or agent workflow is ready to use.

When to use

Use before user-facing release, scheduled runs, autonomous agent execution, decision-impacting analysis, or sharing outputs with others. Use when an agent will write, send, trigger, or act with tools on your behalf.

Inputs

SPEC.md
VERIFY.md
Changed files
Test/build/lint results
Data/model/agent context if relevant
Allowed tools
Forbidden tools or actions
Destructive operations
Secrets and credentials
PII or sensitive data access
Dry-run mode
Human approval gates
Audit logging
Rollback path
Owner notification
Stop conditions

Workflow

Create or update SHIP.md.
Check user-facing behavior or the scheduled/autonomous action.
If the run can write, send, or trigger actions, record allowed tools, forbidden tools or actions, destructive operations, secrets and credentials, PII or sensitive data access, dry-run mode, human approval gates, audit logging, rollback path, owner notification, and stop conditions.
Check test, build, and lint commands.
Check data freshness if relevant.
Check row counts, nulls, and metric deltas if relevant.
Check model artifact/version if relevant.
Check agent tool permissions if relevant.
Decide GO or NO-GO.

Outputs

SHIP.md
GO / NO-GO decision
Blockers
Accepted risks
Rollback plan

Stop conditions

A GO / NO-GO decision is recorded.
A required approval, dry-run, or rollback path is still unclear.
A blocker requires more implementation or verification.

Anti-patterns

Calling something shipped just because the implementation task passed.
Ignoring data freshness or permissions for automated workflows.
Shipping without a rollback path.
Treating autonomous or scheduled runs like interactive sessions.

ship-mini— agent skill

Is ship-mini safe to install?

Ship Mini

Purpose

When to use

Inputs

Workflow

Outputs

Stop conditions

Anti-patterns

Audit the pieces. Scan the whole. Decide.