Install
$ agentstack add skill-floomhq-moto-ship ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Ship Skill
Step 1: QA check
Before shipping, analyze the diff and verify:
- Which files changed and why
- Whether tests exist for the changes
- Whether the change is complete (no TODOs, no debug code, no console.logs)
- Whether env vars or config need updating
Run:
git diff main...HEAD
Step 2: Sync with main
git fetch origin
git rebase origin/main
If conflicts arise, resolve them before continuing.
Step 3: Run tests on the merged code
# Run whatever test suite exists
npm test # or pytest, cargo test, go test, etc.
npm run build # Verify build passes
npm run lint # Verify linting passes
Do NOT ship if tests fail.
Step 4: Pre-landing review
Check the final diff one more time:
git diff origin/main...HEAD
Look for:
- Accidental debug code or console.logs
- Hardcoded values that should be env vars
- Missing error handling
- Breaking changes to public APIs
- Security issues (XSS, injection, exposed secrets)
Step 5: Push
git push origin HEAD
If the branch doesn't exist remotely yet:
git push -u origin HEAD
Step 6: Create PR
gh pr create --title "" --body ""
PR title format: : (e.g., fix: correct auth token expiry, feat: add dark mode)
PR body should include:
- What changed and why
- How to test
- Any breaking changes
- Screenshots for UI changes
Step 7: Verify
After creating the PR:
- Check CI is running (not failing)
- Verify the PR description is accurate
- Return the PR URL to the user
Rules
- NEVER push directly to main/master without a PR (unless repo has no branch protection and user explicitly asks)
- NEVER push with failing tests
- NEVER skip the pre-landing review
- Always create PRs as draft if the work is not complete
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: floomhq
- Source: floomhq/moto
- License: MIT
- Homepage: https://github.com/floomhq/moto#readme
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.