{"id":"32c741f7-ad45-4c2c-b0a0-2d2bd62b4d2f","slug":"munnangiraveena-beep-ship-ready","kind":"skill","name":"ship-ready","summary":"Production-readiness audit for web apps, as an agent skill: 111 production terms + 8 modern-stack extras, tiered by stage, checked against your code with file:line evidence.","owner":"munnangiraveena-beep","repoUrl":"https://github.com/munnangiraveena-beep/ship-ready","license":"MIT","licenseTier":"permissive","trust":"community","stars":2,"match":null,"fewStars":true,"format":"skill","createdAt":"2026-10-21T16:13:27.000Z","addedAt":"2026-10-22T00:03:08.468Z","logoUrl":"https://avatars.githubusercontent.com/u/255220436?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools","cloud-infra","databases"],"tags":["checklist","claude-code","devops","llm","production-readiness","security","supabase","vercel"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-26T19:05:42.142Z","sample":false,"url":"https://conduits.dev/tools/munnangiraveena-beep-ship-ready","language":"Shell","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# ship-ready\n\n**A production-readiness audit for web apps, as an agent skill.**\n\n111 production terms (rate limiting, timeouts, idempotency, backups, CORS, migrations and the rest) plus 8 modern-stack extras for apps built on hosted platforms, managed Postgres and LLM APIs. Each one is tiered by when it actually matters, so you fix the five things that will hurt you this week instead of reading about Kubernetes.\n\nPoint your coding agent at a repo and it reads your code, cites `file:line` evidence for every finding, and tells you what to fix first.\n\n```\n> /ship-ready\n\n# Ship-ready report: invoice-helper · launched · quick\nScore: 🔴 12/28 (2 N/A)\n\n## Fix first\n1. ❌ Row-Level Security (B2): supabase/migrations/20260903_init.sql:41 creates\n   `invoices` without RLS. Anyone with the public anon key can read every invoice.\n2. ❌ Webhooks (#101): app/api/stripe/route.ts:12 trusts the body with no\n   signature check, so anyone can POST \"invoice paid\".\n3. ❌ Idempotency (#14): Stripe redeliveries insert duplicate payments.\n...\n```\n\n[See a full sample report →](skills/ship-ready/examples/sample-report.md)\n\n## Why a skill and not just a checklist?\n\nA checklist gets read once. A skill gets **run**: every time you ship a feature, add a webhook or wire up a new agent. It also does the boring part a checklist can't: grepping for `fetch(` calls without timeouts, finding tables without row-level security, spotting secrets in client bundles, and turning all of that into a short, ranked to-do list.\n\nThe checklist is still here for humans: [CHECKLIST.md](CHECKLIST.md).\n\n## The three tiers\n\n| | Tier | Meaning |\n|---|---|---|\n| 🔴 | **Now** | Bites small apps today. Check every one. |\n| 🟡 | **Growing** | Matters once you have paying clients, real traffic or a teammate. |\n| ⚪ | **Later** | Big-company scale. Know the word, skip the work. |\n\nThe skill shifts tiers with your stage: a weekend prototype gets only the security and backup basics; an app with several instances and a team gets 🟡 promoted to 🔴.\n\n## The short list\n\nIf you do nothing else:\n\n1. **Secrets management**: keys in environment settings or a vault, never in code, chat or the browser bundle.\n2. **Backups and disaster recovery**: database and uploads, off-provider, with a restore you have tested.\n3. **Rate limiting, timeouts, retries, backoff**: on every route and agent that calls an LLM or paid API.\n4. **Idempotency**: a retry must not double-send, double-charge or double-post.\n5. **Webhooks**: verify signatures, deduplicate, log.\n6. **Logging, monitoring, alerts**: know an agent died before a client does.\n7. **IAM and OAuth**: least access for every person, agent and token.\n8. **Cost optimization**: spend caps, the right model per job, no runaway builds.\n9. **Migrations, indexing, row-level security**: database basics.\n10. **SQL injection, XSS, CORS, auth on every route**: the big holes in AI-generated apps.\n\n## Install\n\n### Claude Code (plugin)\n\n```\n/plugin marketplace add munnangiraveena-beep/ship-ready\n/plugin install ship-ready@ship-ready\n```\n\n### Claude Code (manual)\n\n```bash\ngit clone https://github.com/munnangiraveena-beep/ship-ready.git\ncp -r ship-ready/skills/ship-ready ~/.claude/skills/          # for all your projects\n# or\ncp -r ship-ready/skills/ship-ready your-app/.claude/skills/   # for one project, shared with your team\n```\n\n### Other agents\n\nThe skill follows the open [Agent Skills](https://agentskills.io) format: a folder with a `SKILL.md`, reference files and a script. Copy `skills/ship-ready/` into wherever your agent loads skills from. Agents without skill support can be pointed at it directly:\n\n```\nRead skills/ship-ready/SKILL.md and follow it to audit this repository.\n```\n\n### No agent at all\n\n```bash\nbash skills/ship-ready/scripts/scan.sh path/to/your-app\n```\n\nprints the raw evidence (grep leads grouped by checklist number), and [CHECKLIST.md](CHECKLIST.md) works with a pen.\n\n## Usage\n\nAsk in plain words, or name a mode:\n\n| Say | What happens |\n|---|---|\n| \"Is this ready to ship?\" / `/ship-ready` | **quick**: all 🔴 items, ranked fixes |\n| \"Full ship-ready audit\" | **full**: 🔴 and 🟡, ⚪ in one line each |\n| \"Ship-ready check on idempotency\" / `#14` | **deep dive** on one item |\n| \"Ship-ready the changes on this branch\" | **diff**: only items the branch touches |\n\nEvery finding gets a status:\n\n✅ pass · ⚠️ partial · ❌ missing · ❓ can't tell from code (it asks you) · ➖ not applicable · 💤 not yet\n\nThings that live in dashboards (backups, alert rules, spend caps, who has admin) can't be seen from code, so the skill asks you a concrete question instead of guessing.\n\n## What's inside\n\n```\nship-ready/\n├── CHECKLIST.md                     the human checklist: all 119 items, one line each\n├── skills/ship-ready/\n│   ├── SKILL.md                     how the agent runs the audit\n│   ├── references/                  per-section detail: look for, pass, red flags, fix\n│   │   ├── 01-traffic-resilience.md        1–14\n│   │   ├── 02-async-realtime.md           15–24\n│   │   ├── 03-data-concurrency.md         25–40\n│   │   ├── 04-runtime-scaling.md          41–50\n│   │   ├── 05-releases.md                 51–57\n│   │   ├── 06-observability.md            58–66\n│   │   ├── 07-security.md                 67–80\n│   │   ├── 08-schema-recovery.md          81–87\n│   │   ├── 09-cost-performance-network.md 88–100\n│   │   ├── 10-apis-infra-people.md       101–111\n│   │   └── 11-bonus-modern-stack.md       B1–B8\n│   ├── scripts/scan.sh              read-only evidence scanner (bash 3.2+, no dependencies)\n│   └── examples/sample-report.md\n└── .claude-plugin/                  Claude Code plugin and marketplace manifests\n```\n\nThe agent loads only the reference files for the sections it is checking, so a quick audit stays fast.\n\n## Principles\n\n- **Evidence or it didn't happen.** Every pass and every failure cites `file:line`. No citation means \"can't tell\", never a guess.\n- **Secrets never leave the file.** The scanner prints locations of suspected keys, not values, and the skill never repeats them.\n- **Smallest fix first.** Use what the project already has before adding a dependency.\n- **Stage-aware.** A prototype doesn't need canary releases. An app taking payments does need idempotent webhooks.\n\n## Contributing\n\nCorrections, new red flags, better scanner patterns and stack-specific notes are all welcome. See [CONTRIBUTING.md](CONTRIBUTING.md).\n\n## License\n\n[MIT](LICENSE)\n"}