ship-safe
Skill1 starsChanged 18 days agoMITView on GitHub
Defensive security and CI/CD baseline for the user's own apps. Use when adding auth, APIs, env vars, GitHub Actions, deploy, or when they ask to harden, scan, or ship. Not for attacking third-party systems.
2 other projects use a version of this.
Adopted by
Most recently taken up by
- HumSaw/shipwright-skillstheir own version, first seen Nov 8, 2026
- blitzcrieg1/agentmetrytheir own version, first seen Oct 13, 2026
Other versions2 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 2
- blitzcrieg1/agentmetry★ 40same name
- HumSaw/shipwright-skills★ 0same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository67 other files it gives its agents.
- AGENTS.mdAGENTS.md
- skills/humanizer/AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- agent-reachSkill
- animateSkill
- backend-architectureSkill
- ci-security-scanning-with-strixSkill
- diagram-generatorSkill
- eas-app-storesSkill
- emil-design-engSkill
- expo-data-fetchingSkill
- expo-dev-clientSkill
- expo-native-uiSkill
- expo-project-structureSkill
- expo-routerSkill
- expo-upgradeSkill
- final-showcaseSkill
- fix-security-vulnerabilities-with-strixSkill
- fresh-context-reviewSkill
- gsap-coreSkill
- gsap-performanceSkill
- gsap-reactSkill
- gsap-scrolltriggerSkill
- gsap-timelineSkill
- hallmarkSkill
- humanizerSkill
- impeccableSkill
- ml-experimentSkill
- obsidian-markdownSkill
- orchestra-conductorSkill
- orchestra-docsSkill
- orchestra-shipSkill
- orchestra-vaultSkill
- penetration-testing-with-strixSkill
- ponytail-auditSkill
- ponytail-reviewSkill
- ponytailSkill
- postgres-best-practicesSkill
- pretty-mermaidSkill
- prompt-forgeSkill
- r3f-shadersSkill
- react-best-practicesSkill
- reaSkill
- refero-designSkill
- research-paperSkill
- resource-scoutSkill
- review-animationsSkill
- semgrep-adapterSkill
- skill-security-checkSkill
- stitch::code-to-designSkill
- stitch::extract-design-mdSkill
- stitch::extract-static-htmlSkill
- stitch::generate-designSkill
- stitch::manage-design-systemSkill
- stitch::react-componentsSkill
- stitch::upload-to-stitchSkill
- store-releaseSkill
- supabaseSkill
- systematic-debuggingSkill
- taste-designSkill
- The first 60 shown.
The file
We split this skill into the rules it gives an agent
9 rules. About 0 are common, 7 are distinctive, and 2 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈7
Distinctive · estimate
This author's own choices. Worth a look.
2
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 10
Only the user's apps and repos: If they point at a live URL they do not own, refuse.
- Distinctive: line 30
Do this on every Play Store build.
- Distinctive: line 34
Keep one workflow until the app needs more:
- Distinctive: line 42
Do not add matrix pyramids, OIDC, or self-hosted runners unless they asked.
- Distinctive: line 46
When they want a real scan of their code or their deployed app:
- Very specific: line 48
Use Strix skills (penetration-testing-with-strix, then fix-security-vulnerabilities-with-strix).
- Very specific: line 50
Write findings into the vault at projects/<slug>/security.md.
- Distinctive: line 53
If Docker/Strix is not installed yet, say so and give the install steps.
- Distinctive: line 64
When you add security or CI, also add a short review note in the vault so Claude/Antigravity can audit it later.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Ship safe
You do not know this area well. Be concrete, boring, and complete. No theater.
Only the user's apps and repos. If they point at a live URL they do not own, refuse.
Before ship (minimum)
- Secrets only in env / GitHub Actions secrets, never committed
- Auth on every mutating API; IDs authorized as well as authenticated
- User input validated at the boundary; parameterized queries; no raw HTML from users
- CORS, cookies (
HttpOnly,Secure,SameSite), and HTTPS assumed in production - Rate limit login and other expensive routes
- Error messages do not leak stack traces to clients
- Dependency install is lockfile-based
- CI runs lint, tests, and build on every PR
Android (Expo) extra
- Tokens in
expo-secure-store, not plain AsyncStorage - No API keys in the app binary; use your backend
- Auth session expires; logout actually clears storage
- Play: release signing / Play App Signing, not a debug keystore in git
Do this on every Play Store build. Strix still only on apps they own, when Docker works.
CI/CD default (GitHub Actions)
Keep one workflow until the app needs more:
- checkout with
fetch-depth: 0if a security scan needs diffs - setup the real runtime (Node/Python) with cache
npm ci/ equivalent- lint + test + build
- fail the job on failure
Do not add matrix pyramids, OIDC, or self-hosted runners unless they asked.
Security scans
When they want a real scan of their code or their deployed app:
- Use Strix skills (
penetration-testing-with-strix, thenfix-security-vulnerabilities-with-strix). - For PR gating,
ci-security-scanning-with-strix. - Write findings into the vault at
projects/<slug>/security.md. - Fix in code. Re-scan. Do not ship “we will fix later” on auth/injection issues.
If Docker/Strix is not installed yet, say so and give the install steps. Do not fake a pentest.
API connections
- One client module per external API
- Timeouts and retries with jitter
- Never log tokens
- Webhook routes verify signatures
Output
When you add security or CI, also add a short review note in the vault so Claude/Antigravity can audit it later.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.