ship-safe

Audit projects for secrets, vulnerabilities, and risky patterns.

23|7|Updated Feb 14, 2026

Search Tags:#vulnerabilities #ci-cd #security-audit #secrets-detection #pre-ship #ship-safe

Ready to run

npx skills add https://github.com/kinncj/MAPLE --skill ship-safe

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ship-safe
Source: https://github.com/kinncj/MAPLE/tree/main/template/.opencode/skills/ship-safe
Command: npx skills add https://github.com/kinncj/MAPLE --skill ship-safe

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Ship-safe provides automated security and quality auditing of the current project, detecting secrets, vulnerabilities, and risky patterns before release.

Core Features & Use Cases

Detect secrets and sensitive data exposure in codebases.
Identify vulnerabilities and risky patterns prior to shipping.
Use as a pre-merge check in CI or during local development to enforce security gates.

Quick Start

Run the audit from your project root to generate a findings report.

Frequently Asked Questions about ship-safe

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect secrets and vulnerabilities before merging code?▼

Run a pre-ship security audit to detect secrets and vulnerabilities by parsing project findings and surfacing blockers by severity. This automated scan works as a pre-merge check to enforce security gates before release.

What is a pre-ship security scan and when do I need it?▼

A pre-ship security scan audits your project for secrets, vulnerabilities, and risky patterns before release. You need it during pre-merge checks, after adding new dependencies, or when handling authentication and infrastructure changes.

Can I run security audits in CI pipelines for infrastructure changes?▼

Yes, you can run security audits in CI pipelines by setting the ENABLE_SHIP_SAFE environment variable. This respects your CI configuration and local runs, parsing audit results to surface blockers by severity during infrastructure changes.

How do I identify risky patterns and sensitive data exposure in my codebase?▼

Identify risky patterns and sensitive data exposure by running an automated security audit from your project root. The audit generates a findings report that parses results to surface blockers by severity, detecting secrets before release.

Does the audit detect vulnerabilities after adding new dependencies?▼

Yes, the audit detects vulnerabilities after adding new dependencies by scanning the current project. It identifies vulnerabilities and risky patterns, parsing audit results to surface blockers by severity for pre-merge checks.

What's the best way to enforce security gates during local development?▼

The best way to enforce security gates during local development is running automated security audits from your project root. These audits detect secrets, vulnerabilities, and risky patterns, generating findings reports that surface blockers by severity.