Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse. Covers MITRE ATLAS technique mapping, injection signature detection, and adversarial robustness scoring.
shipping-artifacts
shipping-artifacts is an open-source security skill for Claude Code and compatible agents, published by phuryn. Its author describes it as: “The durable documentation set that makes an AI-built (vibe-coded) app reviewable before shipping. A small core every app needs — architecture, user/permission flows, permissions, variables/secrets, and a test-coverage…”. The project has 25k stars on GitHub and is available under the MIT license. Add it to your setup with `/plugin marketplace add phuryn/pm-skills`.
What shipping-artifacts does
AI agents write code fast, but they leave no durable record of *intent* — what the system is supposed to do, who is allowed to do what, where the secrets live, which rules are actually verified. Without that record, no human (and no auditing agent) can tell whether the code is safe to ship. This skill defines the small set of documents that restore reviewability.
Installation
Add shipping-artifacts to your agent with:
/plugin marketplace add phuryn/pm-skillsAlways review a skill's source before installing it. This command comes from the skill's public repository; the linked repo is the source of truth for exact setup steps.
What's inside
The SKILL.md for shipping-artifacts is organised into these sections:
- Purpose
- How the set is organized
- Core documents
- Conditional documents (include only when the capability exists)
- Notes
When to use it
Reach for shipping-artifacts when you want security help from your agent without writing the same instructions every session. Load the skill and the agent picks it up automatically for relevant tasks.
Strengths
- Clear MIT license — safe to read and adapt
- Ships in phuryn/pm-skills, an established project with 25,392 GitHub stars
- Actively maintained (recent commits)
Topics
Frequently asked questions
- What does shipping-artifacts do?
- The durable documentation set that makes an AI-built (vibe-coded) app reviewable before shipping. A small core every app needs — architecture, user/permission flows, permissions, variables/secrets, and a test-coverage map — plus conditional docs added only when they apply: emails, scheduled work, SEO, and embedded agents/automation. Defines what each doc must capture and how a reviewer or auditor uses it. Use when documenting a codebase for handoff, mapping user journeys and trust-boundary crossings, planning test coverage, or preparing for a security or performance audit.
- How do I install shipping-artifacts?
- Run /plugin marketplace add phuryn/pm-skills in your agent, then reload your skills. Review the source at https://github.com/phuryn/pm-skills before installing.
- Is shipping-artifacts free to use?
- Yes. shipping-artifacts is free and open source under the MIT license, so you can read, run, and adapt it within that license's terms.
- Where does shipping-artifacts come from?
- shipping-artifacts ships inside phuryn/pm-skills, a repository that contains 41 catalogued skills in total. The repository's 25,392 GitHub stars apply to that whole collection, not to this skill on its own.
Related skills
More Security →/cs:aims-audit <scope> — ISO/IEC 42001 AIMS internal-audit 6-question forcing interrogation. Use before certification stage 1, before annual internal audit cycles, or when onboarding a new AI system into an existing AIMS.
Audits and designs iOS/macOS/watchOS/visionOS interfaces against the Apple Human Interface Guidelines, including the Liquid Glass design language (announced WWDC25, shipped with iOS 26/macOS Tahoe, Sept 2025). Use when reviewing an Apple-platform mockup or app for HIG compliance, checking contrast or tap-target sizes, or designing native-feeling Apple UI (e.g., 'audit my iOS app against the HIG', 'is this text readable on Liquid Glass?').
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches. AI agents running in CI/CD pipelines.