Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add avizmarlon/agent-skills --skill git-pr-rulesgit clone --depth 1 https://github.com/avizmarlon/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/avizmarlon/agent-skills/git-pr-rules)<a href="https://agentmods.dev/skills/avizmarlon/agent-skills/git-pr-rules"><img src="https://agentmods.dev/badge/skills/avizmarlon/agent-skills/git-pr-rules/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/avizmarlon/agent-skills/git-pr-rules"><img src="https://agentmods.dev/badge/skills/avizmarlon/agent-skills/git-pr-rules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.01607 |
| Opus 5.5 | $0.00031 | $0.00643 |
| Sonnet 5.5 | $0.00015 | $0.00321 |
| Haiku 4.5 | $0.00008 | $0.00161 |
Grade A, and why
git-pr-rules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 108 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pull Requests Always — Never Merge Locally into Main — HARD BLOCK
Principle: All work targeting main (or production-equivalent branch) must go through Pull Request on GitHub/GitLab/Gitea/etc. — never git merge locally followed by git push origin main. No exceptions across any Git-based project using collaborative workflows.
Why
-
Permanent paper trail. PRs remain indexed and shareable forever — a link for documentation, retrospectives, and future debugging ("when did this change land? what was the context?").
git logalone cannot answer "what was tried, rejected, or decided?" -
Squash-merge consolidates. PR allows squashing 5–10 local commits into 1 clean commit per feature. Main remains auditable (1 line per logical change, not 50 noisy commits).
-
Revert is trivial. GitHub's "Revert" button creates a reverse PR; manual
git revert <sha>is error-prone in squashed histories and causes merge conflicts. -
CI/CD gates. Pipelines configured to run on PR catch regressions that local pre-commit hooks miss (E2E tests, security scans, integration tests, etc.).
-
Branch protection enforcement. Production branches should be protected; direct push is blocked anyway. PR is the only path.
-
Discoverability. PR list shows what's in flight to other team members and future sessions —
git loglocal context does not.
Mandatory Workflow
1. Work on feature/fix/* branch (never directly on main)
2. Make local commits with clear messages (Conventional Commits preferred)
3. git push -u origin <branch>
4. gh pr create --title "..." --body "..." (or web UI if preferred)
5. Wait for CI to pass (if configured)
6. Merge via UI (squash-merge for features, merge-commit for complex hotfixes)
7. Branch auto-deleted post-merge
AI responsibility: Execute gh pr create programmatically — do not ask the human to open UI. Return the PR URL for visibility.
Prohibited Anti-patterns — HARD BLOCK
git checkout main && git merge feature/x && git push→ forbidden, even as solo maintainer- "It's just a typo, merging straight to main" → forbidden — open branch + PR (squash-merge resolves in 30 seconds)
- "Branch protection is not enabled on this repo" → irrelevant — this is a process rule, not an enforcement-dependent rule
- Push the branch and "open PR later" → there is no later — PR is opened in the same session
- AI merging locally "to save the human time" → humans explicitly prefer the +30-second PR cost for permanent audit trail. Do not optimize against their stated trade-off.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 108 lines · 77 tokens per session scan A f12696eb9eaa
git-pr-rules is a skill published in the GitHub repository avizmarlon/agent-skills (2 stars, last pushed 4mo ago), licensed MIT. It adds 77 tokens to every session and 1,607 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
deployment-patterns
Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications. Use when setting up deployment infrastructure or planning releases.
mem0-test-integration
Verify a Mem0 integration produced by /mem0-integrate. Runs in the same workspace on the same branch (loose coupling) — installs dependencies, runs the repo's native test suite, then exercises a real end-to-end smoke flow against the user's API key. Produces a scorecard. TRIGGER when: user has just run /mem0-integrate…
resolve-handoff
Emit the complete Resolve handoff with exact modes, outcomes, test evidence, and publication state.
otto-pr-review-loop
Run Polly and OCR on a PR until all findings settle.
baby-sit
Monitor a GitHub pull request until CI is green, diagnose failures, and rerun only evidence-backed flaky GitHub Actions jobs.
merge-drive
Carry a long-running conflicted merge of origin/main into a branch that restructured the tree: read the merge state from the index, resolve by class, and hand it to the next session without losing work. Covers the classes git reports as already-resolved (silent resurrections, directory-rename ports, half-landed…