ship-product
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill implements an 'Env gate' (defined in
references/env-gate.md) which mandates that the agent stops and requests a user-validated.envfile before performing any network operations or live testing. - [COMMAND_EXECUTION]: The skill utilizes local development tools such as Bun, Docker Compose, and various CLIs (TanStack, Drizzle) for scaffolding, database migrations, and local environment management.
- [SAFE]: Instructions explicitly require manual human invocation (e.g., using
$ship-product) and prohibit auto-application, ensuring the user retains control over the execution process. - [SAFE]: The architecture relies on industry-standard libraries and frameworks (TanStack, Elysia, Drizzle, Better Auth, Polar) and emphasizes security best practices such as webhook signature verification and CSRF protection.
- [SAFE]: No hardcoded secrets, obfuscation, or unauthorized data exfiltration patterns were detected; documentation for local database defaults uses standard development placeholders.
Audit Metadata