Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ethanaubuchon/dossier-tradecraft --skill open-draft-prgit clone --depth 1 https://github.com/ethanaubuchon/dossier-tradecraftWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ethanaubuchon/dossier-tradecraft/open-draft-pr)<a href="https://agentmods.dev/skills/ethanaubuchon/dossier-tradecraft/open-draft-pr"><img src="https://agentmods.dev/badge/skills/ethanaubuchon/dossier-tradecraft/open-draft-pr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ethanaubuchon/dossier-tradecraft/open-draft-pr"><img src="https://agentmods.dev/badge/skills/ethanaubuchon/dossier-tradecraft/open-draft-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.00579 |
| Opus 5.5 | $0.00026 | $0.00232 |
| Sonnet 5.5 | $0.00013 | $0.00116 |
| Haiku 4.5 | $0.00006 | $0.00058 |
Grade A, and why
open-draft-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 37 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Open Draft PR
Opens the draft PR that /implement's review step runs inside. Thin: push the branch, create a draft PR, return its ref. The PR is a draft (not ready) so review happens before it's "real" — and so pr-review-toolkit's PR-framed agents (when used via the agent-review ceiling) have a PR object to attach to.
All GitHub/gh coupling lives here and in publish-pr; the recipe and the other primitives stay host-agnostic.
Input
- branch — the feature branch (from
repo-setup), already committed. - title, body — composed by the recipe from the
plan-file/ ticket.
Steps
- Push the branch and set upstream if it isn't on the remote yet:
git push -u origin <branch>. - Idempotency — if a PR already exists for this branch (
gh pr list --head <branch>returns one), return its ref instead of creating a duplicate (gh pr createerrors when one exists). - Open a draft PR:
gh pr create --draft --title "<title>" --body "<body>"— base = the repo's default branch, head = the current branch (ghinfers both; pass--base/--headexplicitly if those defaults don't apply). Add per-repo flags (labels, reviewers) per the project's agent-instruction file. - Capture and return the PR ref (number + URL) from the
ghoutput.
Output / contract
- In: a committed branch + PR title/body.
- Out: the draft PR ref (number/URL), surfaced so
agent-reviewandpublish-prcan target it. - Side effects: pushes the branch (network write); creates a draft PR. Nothing merged or marked ready.
Project overrides
- Provisioning-heavy open steps — a repo with a scripted opener (e.g. domainator's
create-pr.sh: templated body, labels, linked issues) overrides this, keeping the contract (branch → PR ref).
Future scope
- Transitional. Under the post-v1 flow simplification (review the branch directly, no draft PR), this primitive is removed and
publish-prabsorbs PR creation. Keep it thin so its removal is cheap.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 37 lines · 64 tokens per session scan A a64967c95657
open-draft-pr is a skill published in the GitHub repository ethanaubuchon/dossier-tradecraft (3 stars, last pushed 8d ago), licensed MIT. It adds 64 tokens to every session and 579 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
hyalo-changelog
Maintain Keep a Changelog files with Hyalo's changelog profile and add/release commands.
secrets-scan
Pre-commit secrets detection with pattern-based scanning for API keys, tokens, passwords, private keys, and connection strings. Self-contained — no external tools required.
github-sync
Sync local Obsidian vault to GitHub — auto-update README.md and push. Triggers: /github-sync, "sync to github", "push to github", "update repo".
datalad
Retrieves, versions, and publishes scientific datasets with DataLad and git-annex, and captures computational provenance with datalad run, rerun, and containers-run. Use when cloning or fetching data from OpenNeuro, DANDI, datasets.datalad.org, or any DataLad dataset; when a file in a dataset reads as a broken symlink…
ship
Pre-release gate. Run the full gate, responsive + render checks, then produce the release checklist (README badge/current/changelog). Use before tagging a release.
git-workflow
A guide for handling Git repository work safely, including status checks, branches, commits, pushes, pull requests, and rebasing. Git is a version-control system that records code changes and coordinates work between developers.