ship-it — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ship-it (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
One idempotent tick (target ≤2 min of action; waiting happens between ticks). State lives in <repo>/.local/state/ship-it-<prd-slug>.json (create dir if missing; ensure .local/ is gitignored): PR list in stack order, per-PR status, deploys monitored, fixes attempted, soak results. Re-running against unchanged state must produce the same outcome.
Two standing rules, because sub-skill output buries the parent sequence and compaction silently drops instructions:
Goal (tick-scoped): set a session goal now (SlashCommand /goal if available, otherwise state it and treat it as binding): "This tick's fixes applied, state file updated, summary printed." Overall completion lives in the state file — the final tick announces DONE and tells Luc to stop the /loop.
Hard rules: everything goes through PRs — never mutate staging/production directly (no flyctl deploy/secrets set, no dashboard changes; flyctl/Sentry/PostHog are read-only investigation tools). Never merge over red or pending CI. CI/CD is law.
pr:<next unmerged PR in stack order> (from $ARGUMENTS or state file; the first tick builds the PR list from the EXECUTION-REPORTs / plan/INDEX.md of the PRD's — or, when scoped to a single Initiative, just that unit's — brainstorm folders, records the scope (full-prd | initiative:<id> | pr-list) in the state file, and sets the PRD's Index.md row to Shipping — create Index.md if missing).SUCCESS/SKIPPED/NEUTRAL), mergeable=MERGEABLE, and reviewDecision=REVIEW_REQUIRED is the sole reason the merge is blocked (i.e. mergeStateStatus=BLOCKED purely for the missing approval — nothing red, nothing pending) → gh pr merge <n> --admin --squash. Log it in the state file. This is the single sanctioned --admin use; anything red or pending waits for the next tick.deployment, once a repo's deploys report LANDED: staging endpoints + e2e smoke against staging where the repo supports it.babysit-pr handle it next tick.When every PR in the state file is merged, every deploy LANDED, and the soak window is clean — what happens next depends on the recorded scope:
03-Product/PRDs/DONE/, set frontmatter status/last-updated.status: shipped + last-updated; the PRD row stays Shipping and NOTHING moves to DONE/ — a partial scope must never archive the whole PRD.Announce DONE (<scope>) — stop the /loop.
If a tick discovers an unfixable-by-PR situation (e.g. requires Luc's credentials or a paid-plan change), write it to the state file as BLOCKED-HUMAN, surface it loudly in the summary, and keep ticking the rest.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.