Agent skill · security · alirezarezvani
ship-gate
Use before deploying or going live ('am I ready to ship', 'can I deploy', 'preflight check'). Scans the codebase with ship_gate_scanner.py across security, database, deploy, AI, dependencies and observability, and blocks on critical items.
Why this skill is useful
Adds a comprehensive pre-production audit process with specific checks for various stacks that the AI wouldn't reliably generate on its own.
What it needs
Requires go, node, python, rust installed locally. About 4k tokens when loaded. Last updated 2026-08-05. 23,939 stars on the source repository.
What this skill does
Ship Gate Pre-production audit that scans a codebase and reports pass/fail/manual across 8 categories before anything ships. Intercept Behavior When the user says "push to production", "deploy", "ship it", "go live", or similar deploy-intent phrases, do NOT proceed with deployment. Instead: 1. Ask: "Have you run the ship gate? Want me to scan now?" 2. If yes, run the full audit below. 3. If the user says they already ran it, ask when. If more than 24 hours ago or if code changed since, recommend re-running. How It Works Step 1: Detect Stack Run these checks in order to identify the project stack: Report detected stack before proceeding. This determines which checks are relevant. Checks tagged with a specific stack in references/checks.md are skipped if that stack is not detected. Step 2: Run Automated Checks Run categories in this order: SEC, DB, CODE, DEP, AI, DEPLOY, FE, OBS. Security and database first because they produce the most critical findings. For each category, run every auto-scannable check from references/checks.md using the patterns in references/patterns.md. Report progress after each category completes: Report results as: PASS: check passed FAIL: issue found (with file path and line number) SKIP: not applicable to this stack Step 3: Manual Confirmation For checks that cannot be automated (backup restore tested, rollback plan exists, staging test passed), present them as a checklist and ask the user to confirm each one. Step 4: Verdict Classify results into three severities: CRITICAL: must fix before shipping (secrets exposed, no auth on routes, no HTTPS, SQL injection vectors, no RLS on Supabase tables) HIGH: should fix before shipping (no error boundaries, no rate limiting, console.logs in production, no pagination) ADVISORY: recommended but not blocking (no OG tags, no custom 404, no analytics, no SBOM) Final output: If zero critical items remain, verdict is: CLEAR TO SHIP. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/ship-gate--a1d622