📦

ship

Name: ship
Author: cubha

内容修订 r1 高风险 ⚙️ 外部命令

Ship Changes Through a Guarded Git Workflow

Release work often requires repeated Git and pull request steps that are easy to perform inconsistently. This skill organizes those steps into an adaptive workflow with verification, review, and branch synchronization guidance.

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "ship" from https://skillstore.io/skills/cubha-ship.md and its manifest at https://skillstore.io/api/skills/cubha-ship/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/cubha-ship.md 已签名 manifest GET /api/skills/cubha-ship/manifest 已签名 lockfile GET /api/skills/cubha-ship/lockfile

测试它

正在使用“ship”。 Ship my current feature branch after checks pass.

预期结果:

Planned target: feature branch to develop.
Verification: verify.sh completed successfully.
Security review: no critical issues reported.
Awaiting approval before push and pull request creation.

正在使用“ship”。 Promote develop to main with squash merge.

预期结果:

Release target: develop to main.
Merge method: squash.
Database review: no migration changes detected.
Awaiting approval before creating and merging the release pull request.

安全审计

高风险

v1 • 2026/7/22 打开版本化报告

The 63 static findings are false positives caused by Markdown backticks, a safe fixed Git command substitution, a protective secret-name check, and a text-entropy heuristic. Semantic review found that the skill can publish and merge changes without a final confirmation gate, uses incomplete sensitive-file protection, and does not specify safe shell argument handling.

已扫描文件

276

分析行数

复核项

已忽略误报

已确认安全问题 (3)

高

SKILL.md:9 SKILL.md:149-154

Automatic Remote Merge Without Confirmation Gate

The workflow directs the agent to run the full commit, push, pull request, and merge pipeline after parsing arguments. It does not require a final user confirmation before publishing changes or merging a pull request.

The skill explicitly instructs a full pipeline and documents push, PR creation, and merge actions, but no final confirmation checkpoint is described before those external changes.

高

SKILL.md:160-169

Incomplete Sensitive-File Protection

The sensitive-file check is limited to selected names in git status, followed by git add -A. This can miss secrets in files with other names or existing tracked sensitive files.

The documented filename check is narrow and the subsequent add-all command stages every change. The skill provides no content-based secret scanning or comprehensive ignore validation.

中

SKILL.md:29-37 SKILL.md:149-154

Unspecified Shell Escaping for Commit Messages and Branch Names

The workflow inserts a user-derived commit message and branch placeholders into Git commands without stating quoting or argument-array requirements. An implementation that builds shell strings can allow command injection.

The source identifies user-supplied arguments and later uses message and branch placeholders in shell-command examples, but it does not prescribe safe command construction.

风险因素

⚙️ 外部命令 (50)

审计者: claude

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/cubha-ship/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/cubha-ship/security.svg)](https://skillstore.io/skills/cubha-ship?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/cubha-ship?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cubha-ship/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/cubha-ship.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

cubha. (2026). ship security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cubha-ship/audits/1

BibTeX 引用

@techreport{cubha-cubha-ship-2026,
  author = {cubha},
  title = {ship security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cubha-ship/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ship security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "cubha"
date-released: "2026-07-22"
url: "https://skillstore.io/skills/cubha-ship/audits/1"
identifiers:
  - type: other
    value: "skillstore:cubha-ship:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Feature Delivery

Commit a completed feature, open a pull request to develop or main, and synchronize the branch after merge.

Release Promotion

Promote reviewed develop changes to main with a release pull request and a selected merge method.

Small Team Workflow

Use a consistent checklist for tests, security review, database review, and pull request creation.

试试这些提示

Ship Current Feature

Ship my current feature branch using the default workflow. Show the planned actions before any remote change.

Merge Into Develop

Ship these changes to develop with commit message "feat: add account settings". Run all available checks first.

Promote a Release

Ship develop to main using squash merge. Summarize tests, security review, and database review before requesting approval.

Controlled Chain Release

Ship my current feature through develop and then main. Stop for confirmation before each pull request merge and report every remote action.

最佳实践

Review the planned branch, commit message, pull request target, and merge method before approving remote actions.
Keep verify.sh and repository test commands current so the workflow can validate changes reliably.
Use protected branches and required CI checks as independent controls for every merge.

避免

Do not use the workflow to bypass required reviews, CI checks, or branch protections.
Do not rely on filename checks alone to prevent committing credentials or secrets.
Do not run release actions from a dirty or unrelated branch without reviewing the staged changes.

常见问题

What branching models does this skill support?

It detects a develop branch and guides either feature-to-develop-to-main or feature-to-main workflows.

Does the skill run tests?

It runs verify.sh when available and otherwise looks for conventional project validation commands.

Can it merge directly into main?

It guides a pull request workflow and is intended to avoid direct commits to protected branches.

How does it handle database migrations?

It detects common migration and schema paths, then requests database schema review when available.

Does it protect secrets?

It checks selected sensitive filenames, but you should also use a content-based secret scanner and ignore rules.

What permissions are required?

You need local Git access, a configured origin remote, and GitHub permissions to create and merge pull requests.

开发者详情

作者

cubha

许可证

MIT

Skillstore 修订

版本提示

作者未声明版本。

仓库

https://github.com/cubha/claude-workflow-plugins/tree/3172e1a00f7090579f36af20c046828489983c23/plugins/ship/skills/ship

引用

2c7f3ccd7b46be5f136ee6d8ab469e4ef582633e

维护新鲜度

2026/7/22

使用量

0 次下载 · 0 次浏览

文件结构

📄 SKILL.md