ship check

Codebases often rot before they reach production. Hardcoded secrets, missing health checks, and brittle Docker configurations hide in plain sight. This skill provides a production-readiness auditor that scans your repository to determine if it is actually safe for real users. It moves beyond generic linting by providing a weighted Ship Score across security, reliability, and deployment hygiene.

What it does

• Weighted Scoring provides a 0-100 Ship Score across Security, Reliability, Deployment, Documentation, and Hygiene.
• Automated Scanning executes a Python-based heuristic scanner to find leaked keys, missing lockfiles, and configuration gaps.
• Manual Verification confirms scanner findings to distinguish between actual blockers and false positives like test fixtures.
• Remediation Planning generates a prioritized fix list, a rollback strategy, and formatted release notes.
• CI Gating provides logic to block releases that fall below a specific quality threshold.

How it works

1. Auditing starts by running /ship scan to identify vulnerabilities and configuration errors in the project root.
2. Prioritizing breaks findings into Blockers, Should Fix, and Nice to Have categories based on risk.
3. Remediating uses /ship fix to work through the prioritized list or /ship security for deep manual passes.
4. Finalizing generates a formal rollback plan and release notes once the score hits the "Ready to Ship" threshold.

Frameworks & tools

The core scanner requires Python 3. It analyzes repository structures including Dockerfiles, CI/CD pipelines, dependency lockfiles, and environment configurations.

Why this beats prompting it yourself

Generic prompts often miss environment-specific risks like hardcoded secrets in Git history or missing health checks in Dockerfiles. This skill uses a specialized scoring algorithm and a dedicated audit script to ensure consistency that manual chatting cannot replicate.

Use cases

• Pre-deployment Check to verify a codebase is safe before merging to the main branch.
• Incident Planning to generate a concrete rollback plan before a high-risk release.
• Security Triage to identify and rotate leaked API keys or hardcoded credentials.
• Code Hygiene to clean up TODOs, debug logs, and missing documentation before handoff.

Known limitations

The scanner uses heuristics and may flag test fixtures as secrets. It is an automated review, not a professional penetration test or formal compliance certification.