ship-pr

ship-pr is a skill for Claude Code, Codex from conn-castle/agent-layer. It costs 28 tokens per session (903 once invoked), scanned A, original, MIT.

A workflow for preparing one GitHub pull request, the review page used to propose code changes. It covers branch and commit preparation, hosted checks, review feedback, and merge authorization.

In plain words
What is it for?
Use it to create or update a pull request, commit and push changes, monitor CI and feedback, respond to eligible comments, and request approval before merging.
Why use it?
It keeps the steps for getting a change ready for merging in one controlled process. It also monitors continuous-integration checks and review events.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/conn-castle/agent-layer/ship-pr
Any agent
npx skills add conn-castle/agent-layer --skill ship-pr
Clone the repo
git clone --depth 1 https://github.com/conn-castle/agent-layer

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ship-pr

README.md
[![agentmods](https://agentmods.dev/badge/skills/conn-castle/agent-layer/ship-pr.svg)](https://agentmods.dev/skills/conn-castle/agent-layer/ship-pr)
Your own site
<a href="https://agentmods.dev/skills/conn-castle/agent-layer/ship-pr"><img src="https://agentmods.dev/badge/skills/conn-castle/agent-layer/ship-pr.svg" alt="Measured on agentmods" height="20"></a>
Per session 28 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 903 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00028 $0.00903
Opus 5 $0.00014 $0.00451
Sonnet 5 $0.00006 $0.00181
Haiku 4.5 $0.00003 $0.00090

Measured today against content hash 49cd98731e52, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

ship-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/read-pr-comments.sh, scripts/watch-pr-events.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

internal/templates/skills/ship-pr/SKILL.md · 96 lines

How it starts

The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.

ship-pr

Invoking this skill authorizes branch creation, staging, commits, pushes, PR creation or updates, and eligible comment replies needed to prepare one PR for merge. It does not authorize the merge itself.

If references/repo-specific-pr-policy.md exists, read it before starting the workflow and treat it as authoritative.

Inputs

Require a pr_worker dispatch target and use /dispatch-agent for every dispatch. Relay any additional caller input in every pr_worker prompt.

Unless the user narrows the scope, include the entire current working tree.

Workflow

  1. Create a branch when repository norms require one. Commit the intended changes, push, and create or reuse the PR. Derive its title from the changes and fill assets/pr-body-template.md, removing unused sections and placeholders.

  2. Start one watcher in a managed background session. Keep it running until the PR merges or the workflow stops, then stop it. If it exits after a transient transport failure, refetch authoritative state and restart it with the same append-only log.

    bash <skill_dir>/scripts/watch-pr-events.sh \
      --repo <owner/name> \
      --pr <pr-number> \
      --log-file .agent-layer/tmp/ship-pr-events-<pr-number>.jsonl \
      --interval-seconds 300
    
  3. Fetch the current head, checks, and mergeability with gh. Read comments with this stateless command; never infer current state from the watcher log:

    bash <skill_dir>/scripts/read-pr-comments.sh \
      --repo <owner/name> \
      --pr <pr-number>
    

    Dispatch pr_worker for unresolved feedback with the exact PR, head, and references/address-pr-comments.md; for a failed required check, also provide its evidence and references/fix-ci.md. The worker edits the local tree but does not commit, push, or post replies. Resolve mechanical conflicts automatically.

    The PR is ready to merge only when:

    • The PR is mergeable at its latest head.
    • At least one agent or human reviewer has posted feedback as a formal review or comment.
    • Every required check and repository gate is green.
    • Every eligible comment has a validated reply.
    • If the optional repository policy exists, every merge criterion it defines is met.

Read the full file on GitHub · 96 lines

Files

What ships with it

5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +5 lines 49cd98731e52
  2. 4d ago First seen · 91 lines · 28 tokens per session scan A 85a1f5a1a739

Subscribe to this mod's changes

ship-pr is a skill published in the GitHub repository conn-castle/agent-layer (10 stars, last pushed yesterday), licensed MIT. It adds 28 tokens to every session and 903 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.