agentsclimarketplace

Ship it

Skill OneWave-AI/open-agent-stack/plugins/vibe-stack/skills/ship-it

Open-source plugins, managed agents, multi-agent orchestrators, and design tokens for Claude Code, the Agent SDK, and any AI tool. By OneWave AI.

Install
npx -y skills add OneWave-AI/open-agent-stack --skill ship-it

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Pre-flight and deploy -- catch the classic day-one embarrassments (exposed keys, missing env vars, broken build, open endpoints), then ship to Vercel with domains and analytics wired. Use when the app is ready for other humans.

SKILL.md

2.2 KB, as published. Nobody here has run it

Ship It

The gap between "works on my machine" and "live without incident" is a checklist, not luck. Run the pre-flight, fix what it catches, deploy, verify live.

Workflow

  1. Secrets sweep. Grep the repo for keys, tokens, and connection strings in source or committed .env files. Anything found: move to env vars, rotate the exposed value (it is burned the moment it was committed), confirm .env* is gitignored. Verify every NEXT_PUBLIC_ variable is genuinely safe to be public.
  2. Env parity. Diff .env.local against what the code actually reads (process.env. sweep). Every variable the app needs gets set in Vercel before deploy -- the classic day-one failure is the env var that only exists on the laptop.
  3. Honesty check. Production build passes locally (npm run build -- not just dev mode), no route returns mock data pretending to be real, API routes that mutate anything have auth checks, and forms actually submit somewhere (the deployed-with-a-dead-contact-form classic).
  4. Deploy. Push, deploy to Vercel, set the domain if provided, confirm HTTPS. Then verify LIVE, not local: walk the money path on the production URL, check a mobile viewport, confirm OG image and title render in a link preview.
  5. Day-one instrumentation. Analytics wired (whatever the user runs -- Vercel Analytics minimum), error visibility on (at least Vercel's runtime logs reviewed once post-deploy), and the deploy summary written: URL, what shipped, known gaps, the rollback command.

Rules

  • A committed secret is a rotated secret -- no exceptions, no "it's a private repo."
  • Verify on the production URL; localhost passing proves nothing about env vars, domains, or edge behavior.
  • Ship with known gaps listed, never with known gaps hidden -- "search is stubbed" in the summary is fine; discovering it live is not.
  • If the build fails, the answer is fixing the build, never --force or skipping typecheck to get the deploy through.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.