Oneshot Ship

Key points to consider before installing or running this skill: - The SKILL.md requests ANTHROPIC_API_KEY, OPENAI_API_KEY, GitHub authentication, and optionally Linear API credentials, but the registry metadata lists none — assume you will need to provide these. Confirm the exact credentials required before proceeding. - The pipeline will read whole repos and send code and prompts to external LLM services (Anthropic/OpenAI). If your repo contains sensitive information, do NOT run this against private repos unless you trust both the skill source and the LLM providers' data handling. - The tool stores keys in ~/.oneshot/config.json (plaintext in home directory per the doc). Prefer ephemeral or least-privilege tokens, and avoid long-lived secrets in that file. - The skill can operate over SSH and execute commands on remote servers. Only provide SSH access to hosts you fully control and audit what commands the oneshot tool will run (use --dry-run first). - There is no install manifest in the registry; the README suggests installing via bun from a GitHub repo. Verify the upstream repository and its release artifacts before installing any global binary. - Practical mitigations: run in --dry-run or --local mode first, inspect the prompts and what is sent to LLMs (prompts/*.txt and CLAUDE.md), use limited-scope GitHub PATs, use ephemeral LLM keys, and review ~/.oneshot/config.json and history after runs. If you cannot verify the source code or provenance, treat this skill as untrusted.