Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aiya000/dotfiles --skill github-pr-creategit clone --depth 1 https://github.com/aiya000/dotfilesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aiya000/dotfiles/github-pr-create)<a href="https://agentmods.dev/skills/aiya000/dotfiles/github-pr-create"><img src="https://agentmods.dev/badge/skills/aiya000/dotfiles/github-pr-create/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aiya000/dotfiles/github-pr-create"><img src="https://agentmods.dev/badge/skills/aiya000/dotfiles/github-pr-create.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 106 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.01258 |
| Opus 5.5 | $0.00012 | $0.00503 |
| Sonnet 5.5 | $0.00006 | $0.00252 |
| Haiku 4.5 | $0.00003 | $0.00126 |
Grade A, and why
github-pr-create scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.
github-pr-create
Create a pull request using gh pr create with an auto-generated description.
Behavior
-
Check git/gh user consistency:
- Run
git config user.nameto get the local git identity - Run
gh auth statusto identify the active GitHub user - If
gh auth statusshowsX Failed to log in ... (keyring)for all accounts (even though the user has authenticated):- This is a known keyring issue in some environments — treat it as a keyring-unavailable environment
- Do NOT stop; proceed to the Keyring-unavailable fallback section below
- If they differ:
- If acting autonomously: run
gh auth switch --user "$(git config user.name)"- If switch succeeds: continue
- If switch fails: defer this skill. After all other work is done, report to the user: the git/gh user mismatch and that the switch failed
- If not acting autonomously: stop the skill and ask the user to resolve the mismatch before continuing
- If acting autonomously: run
- Run
-
Check current branch status by running
git statusandgit branch -
Inspect the commits ahead of the base branch by running (whichever base exists):
git log main..HEAD --onelinegit log develop..HEAD --onelinegit log master..HEAD --oneline
-
If on
mainormasterbranch, create a new feature branch -
If there are uncommitted staged changes, use the
git-commitskill to commit them first -
Push the branch to remote using the
git-pushskill -
Create a PR using
gh pr createwith auto-generated title and description
Branch Naming Convention
When creating a new branch, use the following prefixes based on the changes:
feature/- New features or enhancementsfix/- Bug fixeshotfix/- Urgent fixes for productionrefactor/- Code refactoringchore/- Maintenance tasks
Example: feature/add-notification-timing, fix/resolve-login-error
PR Description Format
The PR description should be written in English and follow this structure:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 126 lines · 30 tokens per session scan A 5577e387f24e
github-pr-create is a skill published in the GitHub repository aiya000/dotfiles (21 stars, last pushed 3d ago), licensed MIT. It adds 30 tokens to every session and 1,258 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
restart__pull_request
A pull-request restart workflow for replacing a messy review with a new pull request containing one clean commit and a summary of the earlier discussion.
rescue__pull_request_review
An automated workflow for handling GitHub pull-request review comments, applying requested code changes, committing them, and pushing them back.
monitor__pull_request_conflict
An automated check for GitHub pull requests, which are proposed code changes awaiting review or merging.
verify-behavior
Verify or reproduce visible product behavior by driving the real UI with pi-computer-use's checked tools, requiring verified expect postconditions and durable state evidence for meaningful UI flows. Use when triage needs visual reproduction, implementation needs behavioral proof, review needs interactive confirmation…
source-drafting
Use when drafting documents, reports, posts, presentations, or review comments from source materials, or conducting research across provided documents. Enforces read-first drafting, a source map for every claim, agent verification, and separation of verified from unverified claims.
pr-review
Intelligent PR code review with dynamic agent allocation based on change types. Analyzes PR changes and generates targeted review tasks.