Agent Skills › asamassekou10/ship-safe › ship-safe-baseline

ship-safe-baseline

GitHub

管理安全扫描基线，将当前发现作为已知债务接受，仅报告新回归。支持创建、对比变更和清除基线，帮助团队渐进式采纳安全扫描并跟踪技术债务减少进度。

claude-code-plugin/skills/ship-safe-baseline/SKILL.md asamassekou10/ship-safe

Trigger Scenarios

用户希望将当前安全漏洞标记为已知债务用户需要查看自上次基线以来的新增或已修复安全问题用户想要重置安全基线以重新评估所有问题

Install

npx skills add asamassekou10/ship-safe --skill ship-safe-baseline -g -y

More Options

Non-standard path

npx skills add https://github.com/asamassekou10/ship-safe/tree/main/claude-code-plugin/skills/ship-safe-baseline -g -y

Use without installing

npx skills use asamassekou10/ship-safe@ship-safe-baseline

指定 Agent (Claude Code)

npx skills add asamassekou10/ship-safe --skill ship-safe-baseline -a claude-code -g -y

安装 repo 全部 skill

npx skills add asamassekou10/ship-safe --all -g -y

预览 repo 内 skill

npx skills add asamassekou10/ship-safe --list

SKILL.md

Frontmatter

{
    "name": "ship-safe-baseline",
    "description": "Manage your security baseline — accept current findings as known debt, then only report new regressions on future scans. Use when the user wants to adopt security scanning incrementally or suppress existing findings.",
    "argument-hint": "[path] [--diff] [--clear]"
}

Ship Safe — Baseline Management

You are helping the user manage their security baseline. A baseline lets teams "accept" current findings as known technical debt and only see new regressions on future scans.

Understand the request

No flags or just a path → Create/update the baseline
--diff → Show what changed since the baseline was created
--clear → Remove the baseline

Step 1: Run the baseline command

npx ship-safe@latest baseline $ARGUMENTS 2>&1

If $ARGUMENTS is empty, default to .:

npx ship-safe@latest baseline . 2>&1

For diff mode:

npx ship-safe@latest baseline . --diff 2>&1

For clearing:

npx ship-safe@latest baseline --clear 2>&1

Step 2: Explain the result

If creating a baseline:

Report how many findings were baselined
Explain that .ship-safe/baseline.json was created
Tell the user they can now run npx ship-safe audit . --baseline (or /ship-safe --baseline) to only see new findings
Recommend adding .ship-safe/baseline.json to version control so the whole team shares the same baseline

If showing diff:

Report new findings (not in baseline) — these are regressions
Report resolved findings (in baseline but no longer detected) — these are improvements
If no changes, confirm the codebase matches the baseline

If clearing:

Confirm the baseline was removed. Future scans will show all findings again.

Step 3: Suggest workflow

After creating a baseline, suggest this workflow:

CI pipeline: Add npx ship-safe audit . --baseline --json to fail builds only on new findings
Periodic review: Run /ship-safe-baseline --diff to track progress on reducing technical debt
After fixing: Run /ship-safe-baseline . to update the baseline

Important Notes

The baseline uses content-based fingerprints (rule:path:snippet), not line numbers — so the baseline survives code reformatting and line shifts
Creating a baseline does NOT mean the findings are safe — it means the team acknowledges them and will address them over time