Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add event4u-app/agent-config --skill finishing-a-development-branchgit clone --depth 1 https://github.com/event4u-app/agent-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/event4u-app/agent-config/finishing-a-development-branch)<a href="https://agentmods.dev/skills/event4u-app/agent-config/finishing-a-development-branch"><img src="https://agentmods.dev/badge/skills/event4u-app/agent-config/finishing-a-development-branch/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/event4u-app/agent-config/finishing-a-development-branch"><img src="https://agentmods.dev/badge/skills/event4u-app/agent-config/finishing-a-development-branch.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 136 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Excessive Agency · line 66 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.02288 |
| Opus 5 | $0.00023 | $0.01144 |
| Sonnet 5 | $0.00009 | $0.00458 |
| Haiku 4.5 | $0.00005 | $0.00229 |
Grade A, and why
finishing-a-development-branch scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 253 lines — stays where its author put it; the contents beside it link to each section on GitHub.
finishing-a-development-branch
When to use
- Implementation of a feature or bug fix is complete on a development branch
- All planned commits are in, the user is ready to hand off
- You are about to say "done" and suggest the next action
- The branch has been idle and the user wants to decide its fate
Do NOT use when:
- Still implementing — use targeted verification, not the ship gate
- A PR already exists and is mid-review — use
receiving-code-review - Only documentation changed and no tests apply — simplify to commit + PR without the full gate
Goal
Route a finished branch to its next state with evidence — merged, pushed for PR, parked, or discarded. Never let a half-verified branch become a PR. Never destroy work without explicit confirmation.
The Iron Law
NO MERGE, NO PR, NO DISCARD WITHOUT VERIFIED TESTS + EXPLICIT CHOICE.
Skipping verification because "it worked a minute ago" is how broken
main happens. Discarding because "I assumed the user meant it" is
how work gets lost.
Procedure
1. Inspect the current branch state
Before presenting any options, gather context. Do not assume — check:
git status— clean, or still dirty?git log --oneline <base>..HEAD— what commits are actually on this branch?git branch --show-current— the branch name you will be operating on- Remote state — is the branch pushed? Is there an open PR already?
If a PR already exists for this branch, stop — this is not a
finishing step, route to receiving-code-review
or fix-pr-comments instead.
2. Verify readiness
Run the end-of-work gate before presenting any options — see
verify-completion-evidence.
Steps 1–3 run only when quality.local_auto_run: true; under the
default (false / missing) skip them without asking — the user runs
quality tools manually, remote CI on the PR is the authoritative gate,
and the readiness report says "quality gates delegated to remote CI"
instead of claiming them green:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 253 lines · 47 tokens per session scan A c7b7b63f01e4
finishing-a-development-branch is a skill published in the GitHub repository event4u-app/agent-config (10 stars, last pushed today), licensed MIT. It adds 47 tokens to every session and 2,288 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
workflow-patterns
Use this skill when implementing tasks according to Conductor's TDD workflow, handling phase checkpoints, managing git commits for tasks, or understanding the verification protocol.
Changelog Test Mapper
Map changelog entries and release notes to affected test cases, ensuring every user-facing change has corresponding test coverage verification.
AI Release Guardian
Analyze a git diff, map affected risks, select the tests that matter, detect coverage gaps on changed lines, run configurable quality gates, and produce a go/no-go release report with cited evidence. Recommends only; never merges or deploys.
verify-before-done
Proves work with tests, diffs, and logs before sign-off.
release-gate-loop
A release check that tests a change, reports whether it passes, and can run a limited fix-and-retest cycle. A release is the act of making a software version available.
am-command-build
Implement the next task incrementally — build, test, verify, commit.