Install
$ agentstack add skill-stefan-stepzero-shipkit-shipkit-update ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
shipkit-update - Install & Update Shipkit
Purpose: One skill to install Shipkit fresh or update an existing installation. Archives previous versions safely and intelligently merges user content.
Role: Bootstrap/update skill. Can be fetched directly from GitHub even before Shipkit is installed.
Why This Skill Exists
Updates are tricky without version tracking and safe migration.
This skill provides:
- Detection - Finds all Shipkit variants (current + legacy naming)
- Safe archiving - Never deletes, always preserves
- Clean install - Fresh framework files from source
- Intelligent merge - Claude merges user content into new structure
When to Invoke
User-invoked:
- "Install Shipkit" / "Update Shipkit" / "Upgrade Shipkit"
/shipkit-update(explicit)- "Reinstall Shipkit from GitHub"
Bootstrap scenario:
- User pastes GitHub link + "install this"
- Claude fetches this skill directly and executes
Prerequisites
For installation:
- Access to GitHub (WebFetch or gh CLI)
- Write access to project root
For update:
- Existing Shipkit installation (any version)
Process
Completion Tracking (MANDATORY)
After getting user permission (Step 0), create tasks for every remaining step:
TaskCreate: "Detect existing installation"TaskCreate: "Archive existing installation + write MANIFEST.md"TaskCreate: "Run npx installer"TaskCreate: "Merge CLAUDE.md (+ subfolder CLAUDE.md files)"TaskCreate: "Merge settings.json"TaskCreate: "Scan settings.local.json for stale refs"TaskCreate: "Migrate user content from archive"TaskCreate: "Cleanup deprecated .md files"TaskCreate: "Output comprehensive summary"
Rules:
TaskUpdateeach task tocompletedonly after the step is fully done- The installer completing (Step 3) is NOT the finish line — 5 more steps remain
- Do NOT present the final summary until ALL tasks show completed
- The CLAUDE.md merge task includes subfolder CLAUDE.md files, not just root
Step 0: Request Permissions Upfront
Get user approval once at the start, then run without interruptions.
Present to user:
To update Shipkit, I need permission to:
1. **Run npx installer** — Download and install latest Shipkit from npm
2. **Modify files** — Update .claude/, .shipkit/, and CLAUDE.md
This will:
- Archive your current installation (nothing deleted)
- Install fresh framework files
- Preserve your specs, plans, progress, and other user content
Proceed? [y/n]
If approved: Continue without further permission prompts. If declined: Stop and explain what manual steps user can take.
Step 1: Detect Existing Installation
Scan for ALL Shipkit variants:
Detection targets:
├── .shipkit/ # Current context folder
├── .shipkit-lite/ # Legacy context folder
├── .claude/
│ ├── skills/shipkit-*/ # Current skills
│ ├── skills/lite-*/ # Legacy skills
│ ├── agents/shipkit-*.md # Current agents
│ ├── agents/lite-*.md # Legacy agents
│ ├── hooks/shipkit-*.py # Current hooks
│ ├── hooks/lite-*.py # Legacy hooks
│ ├── rules/shipkit.md # Framework rules (replace on update)
│ ├── settings.json # Main settings (check _shipkit key)
│ └── settings.local.json # Local overrides (check for stale refs)
├── CLAUDE.md # Root (user-editable, merge carefully)
└── **/CLAUDE.md # Subfolders (check for Shipkit sections)
Version detection:
- Grep for
Shipkit vpattern in all found files - Check
_shipkitkey in JSON files - Look for legacy markers:
Shipkit-Lite,lite-,BEGIN Shipkit-Lite - Record highest version found
Output:
Detected Shipkit installation:
- Version: v1.0.0 (from 12 files)
- Context folder: .shipkit/
- Skills: 15 found (shipkit-* prefix)
- Agents: 6 found
- CLAUDE.md: Has Shipkit section (with markers / without markers)
- settings.json: Has _shipkit key
- settings.local.json: Found (has stale lite-* refs / clean)
- User content: why.md, architecture.json, 3 specs
Step 2: Archive Existing Installation
Always archive before any changes.
Create archive folder:
.shipkit-archive/
└── {YYYYMMDD-HHMMSS}/
├── context/ # From .shipkit/ or .shipkit-lite/
│ └── [entire .shipkit/ contents]
├── skills/ # All shipkit-* and lite-* skills
├── agents/ # All shipkit-* and lite-* agents
├── hooks/ # All shipkit-* and lite-* hooks
├── CLAUDE.md.backup # Full backup of root CLAUDE.md
├── settings.json.backup # Full backup of settings
└── MANIFEST.md # What was archived + versions
MANIFEST.md format:
# Shipkit Archive Manifest
Archived: 2024-01-15 14:30:00
Previous version: v1.0.0
Upgrading to: v1.1.0
## Archived Framework Files
- 15 skills (shipkit-* prefix)
- 7 agents
- 2 hooks
- settings.json entries
## Archived Context (entire .shipkit/ folder)
All files preserved in context/ subfolder.
## Other Backups
- CLAUDE.md (full backup)
- settings.json (full backup)
## Version Map
| File | Version |
|------|---------|
| shipkit-orchestrate/SKILL.md | v1.0.0 |
| shipkit-spec/SKILL.md | v1.0.0 |
| settings.json (_shipkit) | v1.0.0 |
| CLAUDE.md | v1.0.0 (or "no markers") |
...
## Notes
- settings.local.json was NOT archived (user's local file)
- Original files preserved here if merge needs review
Step 3: Run npx Installer
Run the npx CLI to install/update framework files:
npx github:stefan-stepzero/shipkit update -y --claude-md skip
> When the npm package is published, this becomes: npx shipkit-dev update -y --claude-md skip
-yfor non-interactive (we already got permission in Step 0)--claude-md skip(Claude will do intelligent merge in Step 4)
What the installer handles:
- Downloads latest from GitHub (or npm once published)
- Installs:
- Skills →
.claude/skills/shipkit-*/ - Agents →
.claude/agents/ - Hooks →
.claude/hooks/ - Settings →
.claude/settings.json(merges — preserves custom permissions) - Rules →
.claude/rules/shipkit.md - Scripts →
.shipkit/scripts/ - HTML Overview →
.shipkit/shipkit-overview.html
- Updates VERSION in
.shipkit/
Fallback (if npx unavailable):
curl -sL https://raw.githubusercontent.com/stefan-stepzero/shipkit/main/installers/install.py -o /tmp/shipkit-install.py
python /tmp/shipkit-install.py --from-github -y --claude-md skip
rm /tmp/shipkit-install.py
Why use the npx CLI:
- Single source of truth for "what to install"
- Zero dependencies, handles file copying and settings merge
- Tested and maintained separately
- Claude focuses on intelligence (detection, archiving, merging user content)
Step 4: Intelligent Merge (CLAUDE.md)
This is where Claude uses judgment, not rigid rules.
Scenario A: Fresh install (no existing CLAUDE.md)
→ Create CLAUDE.md with full Shipkit template (with BEGIN/END markers)
Scenario B: Existing CLAUDE.md WITH markers
...old shipkit content...
→ Replace content between markers with new template → Update version in markers → Preserve everything outside markers
Scenario C: Existing CLAUDE.md WITHOUT markers (legacy or manual)
Claude analyzes and merges intelligently:
- Read new Shipkit template (canonical structure)
- Read old CLAUDE.md content
- For each piece of old content, determine:
- Is it old Shipkit instruction? → Drop (replaced by new)
- Is it user preference? → Add to "Working Preferences" section
- Is it project-specific knowledge? → Add to "Project Learnings" section
- Is it unrelated to Shipkit? → Preserve below END marker
Judgment calls Claude makes:
| Old Content | Action | |-------------|--------| | "Always use TypeScript strict mode" | → Working Preferences | | "This project uses Prisma for ORM" | → Project Learnings | | "Run /lite-spec for specifications" | → Drop (old command) | | "Check .shipkit-lite/ for context" | → Drop (old path) | | "Never commit .env files" | → Project Learnings | | Company coding standards section | → Preserve below END marker | | Old Shipkit skill reference tables | → Drop (replaced) |
- Write merged CLAUDE.md with proper markers
- Archive has original if user wants to review
For subfolder CLAUDE.md files:
- Same logic applies
- Check each
**/CLAUDE.mdfound during detection - Merge each one individually
Step 5: Intelligent Merge (settings.json)
Same principle: Claude merges with judgment.
- Read new Shipkit settings template
- Read old
.claude/settings.json - Merge intelligently:
| Section | Action | |---------|--------| | _shipkit | → Update to new version | | permissions.allow with Skill(shipkit-*) | → Replace with new skill list | | permissions.allow with Skill(lite-*) | → Remove (legacy) | | permissions.allow (other entries) | → Preserve (user's custom permissions) | | permissions.deny | → Merge (keep user's, add Shipkit's) | | hooks (entire section) | → Replace with new template's hooks | | skills, workspace sections | → Replace with new | | Any other keys | → Preserve (user's additions) |
Hooks merge detail: Replace the entire hooks section with the new template. This ensures new hook types are added when they didn't exist in the old settings. All Shipkit hook types must be present:
SessionStart— context loader (session initialization)PostToolUse— skill usage trackingTaskCompleted— team quality gateTeammateIdle— team quality gate
- Write valid JSON
- Archive has original backup
Example preservation:
// Old settings.json had:
"permissions": {
"allow": [
"Skill(shipkit-spec)", // ← Replace (Shipkit)
"Skill(lite-plan)", // ← Remove (legacy)
"WebFetch(domain:myapi.com)", // ← PRESERVE (user)
"Bash(terraform:*)" // ← PRESERVE (user)
]
}
// New merged settings.json:
"permissions": {
"allow": [
"Skill(shipkit-spec)", // New Shipkit
"Skill(shipkit-plan)", // New Shipkit (renamed)
...all new shipkit skills...
"WebFetch(domain:myapi.com)", // Preserved
"Bash(terraform:*)" // Preserved
]
}
Step 6: Handle settings.local.json
Do NOT modify this file. It's the user's local overrides.
But warn if stale patterns detected:
Scan for:
lite-*references- Old Shipkit version markers
- Paths to
.shipkit-lite/
If found, output warning:
⚠ settings.local.json contains outdated references:
- "Skill(lite-spec)" → should be "Skill(shipkit-spec)"
- Path ".shipkit-lite/" → should be ".shipkit/"
This file was NOT modified (it's your local config).
Consider updating these references manually.
Step 7: Migrate User Content
Principle: Migrate everything EXCEPT known framework/transient files.
This approach is future-proof — new user content files automatically migrate without needing to update this list.
DON'T migrate (framework - install fresh):
├── templates/ # Framework templates from install
└── queues/ # Transient task queues, start empty
DON'T migrate (purely auto-generated):
├── schema.json # Auto-generated from migrations
└── env-requirements.md # Auto-generated from .env files
MIGRATE: Everything else in .shipkit/
This includes (but is not limited to):
why.json- Vision document (deprecated:why.md)architecture.json- Architecture decisionsstack.json- Tech stack (may have manual annotations)specs/**- Feature specifications (active and implemented, .json preferred)plans/**- Implementation plans (.json preferred)progress.json- Session historyarchives/**- Progress archivescodebase-index.json- Navigation indexproduct-discovery.json- User personas and journeysengineering-definition.json- Technical approach and data contractscodebase-index.json- Component/route index (replaces deprecated implementations.json)user-tasks/**- User task listspreflight.json- Audit reportsaudits/**- Audit historyux-decisions.json- UX decision log (deprecated:ux-decisions.md)communications/**- Generated HTML reportsstatus.json- Health snapshots- Any other user-created files
Note on stack.json: While initially auto-generated, users often add manual notes and decisions. Migrating preserves this context. If user wants fresh detection, they can run /shipkit-project-context after update.
Migration process:
- List all files in archived
.shipkit/context folder - Exclude:
templates/,queues/,schema.json,env-requirements.md - Copy everything else to new
.shipkit/ - Report what was migrated
- Note that schema.json/env-requirements.md can be regenerated if needed
Step 8: Cleanup Deprecated File Formats
Skills now output JSON instead of markdown for structured data.
After migration, scan for deprecated .md files that have been superseded by .json:
| Deprecated File | Replacement | Skill That Creates It | |-----------------|-------------|----------------------| | architecture.md | architecture.json | /shipkit-engineering-definition | | progress.md | progress.json | /shipkit-work-memory | | product-discovery.md | product-discovery.json | /shipkit-product-discovery | | contracts.md | — (folded into engineering-definition.json) | /shipkit-engineering-definition | | preflight.md | preflight.json | /shipkit-preflight | | scale-readiness.md | scale-readiness.json | /shipkit-scale-ready | | prompt-audit.md | prompt-audit.json | /shipkit-prompt-audit | | schema.md | schema.json | /shipkit-project-context | | implementations.md | — (removed, use codebase-index.json) | /shipkit-codebase-index | | specs/active/*.md | specs/active/*.json | /shipkit-spec | | plans/active/*.md | plans/active/*.json | /shipkit-plan | | why.md | why.json | /shipkit-why-project | | ux-decisions.md | ux-decisions.json | /shipkit-ux-audit |
Cleanup process:
- Scan
.shipkit/for deprecated.mdfiles from the table above - For root-level files (architecture.md, progress.md, why.md, etc.):
- Check if
.jsonequivalent already exists - If YES: Archive
.mdto.shipkit-archive/{timestamp}/deprecated-md/, remove from.shipkit/ - If NO: Keep
.md(will be converted when user runs the skill)
- For directory-based files (specs/active/, plans/active/):
- Scan each directory for
.mdfiles - For each
.mdfile, check if matching.jsonexists (same basename) - If YES: Archive
.mdto.shipkit-archive/{timestamp}/deprecated-md/{subpath}/, remove from.shipkit/ - If NO: Keep
.md(will be converted when user runs/shipkit-specor/shipkit-plan)
- Report findings:
Deprecated file formats detected:
Found .md files with .json replacements (archived):
✓ architecture.md → archived (architecture.json exists)
✓ progress.md → archived (progress.json exists)
✓ why.md → archived (why.json exists)
✓ specs/active/user-auth.md → archived (user-auth.json exists)
✓ plans/active/user-auth.md → archived (user-auth.json exists)
Found .md files pending conversion:
⚠ product-discovery.md — run /shipkit-product-discovery to convert
⚠ ux-decisions.md — run /shipkit-ux-audit to convert
⚠ specs/active/payment-flow.md — run /shipkit-spec to convert
⚠ plans/active/api-refactor.md — run /shipkit-plan to convert
These skills now output JSON for structured data.
Run each skill to convert, or keep .md files (they still work).
Why this matters:
- JSON files enable better tooling and cross-skill q
…
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: stefan-stepzero
- Source: stefan-stepzero/shipkit
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.