Add ship-gate: Pre-production audit skill

[rx4u]

Summary

Adds ship-gate, a pre-production audit skill for the `engineering/` category.

Scans a codebase across 8 categories — security, database, deployment, code quality, AI/LLM, dependencies, frontend, and observability — with 89 automated and manual checks. Intercepts deploy-intent phrases ("push to production", "ship it", "go live") and blocks until critical issues are resolved. Stack-agnostic.

• Repo: https://github.com/rx4u/ship-gate
• Install: `claude plugin add github:rx4u/ship-gate`
• Author: Rajaraman Arumugam (@rx4u)

Checklist

• Target branch is `dev` (not `main` — PRs to main will be auto-closed)
• Skill has `SKILL.md` with valid YAML frontmatter (`name`, `description`, `license`)
• Scripts (if any) run with `--help` without errors
• No hardcoded API keys, tokens, or secrets
• No vendor-locked dependencies without open-source fallback
• Follows existing directory structure (`domain/skill-name/SKILL.md`)

Type of Change

• New skill

Testing

Manually tested against a local Next.js + Supabase project. Ran the skill via Claude Code, confirmed:

• Stack detection correctly identified Next.js + Supabase + Vercel
• SEC and DB category scans flagged real issues (exposed env vars, missing RLS)
• Manual confirmation checklist presented correctly
• Verdict output matched expected format

This is v1.0.0. Includes `scripts/ship_gate_scanner.py` — a stdlib-only Python CLI that runs all auto-detectable checks, with JSON output mode, ANSI color, interactive manual prompts, and exit codes (0=CLEAR, 1=CRITICAL, 2=HIGH).

[alirezarezvani]

Hi @rx4u — thanks for this submission. The content quality here is genuinely strong — 89 well-organized checks with actual grep/regex patterns across 8 categories is substantial work, and the pre-deploy intercept design is clever. This is much more than a stub.

However, a few things need fixing before we can merge.

1. "Production-tested" claim

The source repo was created today (April 13) with 0 stars and 0 forks. The PR body says these are "production-tested skills" — we can't verify that. Please either:

• Remove the claim, or
• Provide evidence (screenshots, deployment logs, links to projects where this was used)

2. Non-existent skill references in SKILL.md

Lines 190-196 reference skills that don't exist in our repo:

- app-planner
- subagent-orchestrator
- backend-patterns
- shadcn-stack / heroui-stack

Please replace these with actual skills from our repo that relate. Suggestions:

## Integration Points

- **karpathy-coder**: run ship-gate after karpathy-check passes — simplicity first, then production readiness
- **adversarial-reviewer**: deep security review for items ship-gate flags as critical
- **security-pen-testing**: penetration testing methodology for SEC-category findings
- **code-reviewer**: general code quality review complements ship-gate's automated checks
- **systematic-debugging**: deep investigation of flagged issues

3. Missing frontmatter fields

Add license: MIT to the SKILL.md frontmatter. Current frontmatter:

---
name: ship-gate
description: >
  Pre-production audit that scans a codebase...
metadata:
  author: Rajaraman Arumugam
  version: 1.0.0
---

Should be:

---
name: ship-gate
description: >
  Pre-production audit that scans a codebase...
license: MIT
metadata:
  author: Rajaraman Arumugam
  version: 1.0.0
---

4. Nice-to-have: a Python scanner script

Your patterns.md contains 687 lines of grep patterns that are begging to be a CLI tool. Adding a scripts/ship_gate_scanner.py that runs the auto-detectable checks and produces a pass/fail report would elevate this from "good documentation" to "production-grade skill" and match the quality bar of our other engineering skills (which all ship Python tooling).

This isn't blocking — we'd accept without it — but it would make the skill significantly more useful and we'd be happy to help you build it if you want.

Summary

Item	Status
Content quality	✅ Strong — 89 checks, real patterns, good structure
Production claim	❌ Fix — remove or substantiate
Skill references	❌ Fix — replace with skills that exist in our repo
Frontmatter	❌ Fix — add license: MIT
Python script	⚡ Nice-to-have (not blocking)

Looking forward to the updated PR — this is close to mergeable.

[alirezarezvani]

Quality review — the skill itself looks good (MIT, stdlib-only Python, deterministic, no network calls, valid SKILL.md frontmatter, no red flags). Two small things to address before merge:

1. Path rebase. Current dev (post-#593) places sub-skills under engineering/skills/<skill-name>/. Please move engineering/ship-gate/ → engineering/skills/ship-gate/ and rebase onto current dev.

2. Plugin manifest (optional, recommended). Standalone plugins typically include a .claude-plugin/plugin.json so they can be installed via the marketplace. If you want this distributed standalone (in addition to bundled in engineering-advanced-skills), add a manifest. Otherwise, the auto-discovery from the umbrella plugin will pick it up via the relocated path.

Once rebased, ping here and we'll get it merged. Thanks for the contribution — the stdlib-only design and 89-check coverage are exactly what we look for.

---

Generated by Claude Code

[alirezarezvani]

Hi @rx4u — the ship-gate skill landed on dev via #604 (merged). Your branch was based on the pre-#593 layout, so applying the diff as-is would have undone the umbrella restructure (4500+ rename ops). I re-applied just the actual new content (SKILL.md, references/checks.md, references/patterns.md, scripts/ship_gate_scanner.py) at the correct post-restructure path (engineering/skills/ship-gate/), with a Co-authored-by trailer crediting you. Thanks for the contribution — closing this in favor of the merged version.

---

Generated by Claude Code