roborew/ship
skills/ship/SKILL.md
Commit → push → PR with explicit confirmation at each step
testing
Updated May 15, 2026
$ install --global
skillsauthnpx skillsauth add roborew/opencode shipInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 15, 2026, 8:24 AM185.3s1 file scanned
SKILL.md
- name:
- ship
- description:
- Commit → push → PR with explicit confirmation at each step
Ship workflow
Use when the user wants to land changes safely.
- Status —
git status; list what will ship. - Stage — propose
git addpaths; exclude.env*,*.pem,*lock*unless user explicitly wants lockfiles,node_modules/,dist/,build/. - Confirm — ask user to confirm staged set.
- Commit — draft message from
git log --oneline -10style; user confirms body. - Push — feature branch only; never push to protected branches without user confirmation.
- PR —
gh pr createwith title/body; user confirms.
Hard rules
- No force push,
git reset --hard,git clean -f/-fd,git branch -D,git checkout .,git restore ., orrm -rf //rm -rf ~. NoDELETESQL withoutWHERE. NoDROP/TRUNCATE TABLEwithout explicit user confirmation in chat. git push --force-with-leaseonly if user typed explicit approval andOPENCODE_ALLOW_FORCE_PUSH=1is set in the environment.- Before running a risky git command, optionally validate with
scripts/preflight-git.sh '<command>'from repo root (this config:~/.config/opencode/scripts/). Hook:scripts/block-dangerous-git.shreads JSON stdin{"tool_input":{"command":"..."}}if your host supports PreToolUse-style interception (OpenCode: see README — not wired inopencode.jsonhere). - No secrets in commit message.
- Stop if tests fail or user cancels any step.
Related Skills
roborew/code-review
tools
VerifiedTrustedCommunity
AI-powered code review using CodeRabbit CLI. Use only on explicit user request or when parent passes execution_mode orchestrate_coderabbit_gate. Do not run during orchestrated stage/issue work.
SKILL.mdUpdated Jun 5, 2026
roborew/fanout-issues
tools
VerifiedTrustedCommunity
Cross-repo companion to to-prd: after PRD frontmatter is filled, run bin/fanout <slug> from this spec repo to create child GitHub issues (one per ticket or legacy slice).
SKILL.mdUpdated Jun 2, 2026
roborew/triage
tools
VerifiedTrustedCommunity
Issue state machine — transition GitHub issue labels per docs/agents/triage-labels.md. Batch helpers via lib/triage.sh.
SKILL.mdUpdated Jun 2, 2026
roborew/to-prd
documentation
VerifiedTrustedCommunity
Synthesise a PRD from grill-me / research context, write docs/prd/<slug>.md, publish a GitHub issue with prd + state:ready-for-agent + feature:<slug>. Halt after publish — do not invoke fanout.
SKILL.mdUpdated Jun 2, 2026