Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fighter90/career-ops-ui/contributor-prnpx skills add Fighter90/career-ops-ui --skill contributor-prgit clone --depth 1 https://github.com/Fighter90/career-ops-uiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fighter90/career-ops-ui/contributor-pr)<a href="https://agentmods.dev/skills/fighter90/career-ops-ui/contributor-pr"><img src="https://agentmods.dev/badge/skills/fighter90/career-ops-ui/contributor-pr.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00065 | $0.01349 |
| Opus 5 | $0.00032 | $0.00674 |
| Sonnet 5 | $0.00013 | $0.00270 |
| Haiku 4.5 | $0.00006 | $0.00135 |
Grade A, and why
contributor-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
contributor-pr — external PR intake pipeline
Proven on v1.125.2 (PRs #144/#145 by @Alien10140 — Gemini defaults + the headless deep-prompt 502 fix). External code gets a stricter path than our own branches: fork CI does not auto-run, review claims are verified empirically, and merges need explicit user authorization.
Phase 1 — Review (local runs ARE the CI gate)
- Fork PRs from first-time contributors show "no checks reported" —
GitHub Actions waits for maintainer approval. Don't chase it; the local
full-suite run below substitutes, and push-CI on main re-validates after
merge. (Approving runs via
gh api …/actions/runs/<id>/approveandgh pr mergeare both classifier-blocked for external PRs — when blocked, STOP and hand the user the exact commands; never work around.) git fetch origin pull/<n>/head:pr-<n>and read the FULL diff. Extra scrutiny on LLM surfaces (prompts.mjs,routes/llm.mjs), sanitizers, any new ingress, and i18n snapshot regeneration (dup keys / glosses). Check the contributor's tests honor CI isolation (dynamic imports inbefore(),CAREER_OPS_ROOTmktemp — the paths-once rule).- Verify factual claims against live sources, never training data.
v1.125.2 lesson: an AI review called
gemini-3.6-flash"fabricated" as a BLOCKER; fetching https://ai.google.dev/gemini-api/docs/models proved the contributor right (3.6-flash Stable, 2.0-flash shut down). Model ids, API shapes, deprecations → WebFetch the official docs. - Run the full suite on EACH pr-branch:
npm test, capture the exit code directly (never pipe to grep). Record per-branch counts. - Before merging, re-check
gh pr view <n> --json headRefOidstill equals the SHA you reviewed.
Phase 2 — Merge
- Needs the user's explicit go for THESE PRs (standing "merge all branches" does not auto-extend to external code; the classifier enforces this).
gh pr merge <n> --squash --delete-branch, oldest first; thengit checkout mainas its OWN command, thengit pull(a checkout inside a blocked compound command silently never runs; v1.125.2: a README commit landed on the local pr-144 branch that way and had to be cherry-picked to main).- Full suite on merged main.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 93 lines · 65 tokens per session scan A b2770d6232eb
contributor-pr is a skill published in the GitHub repository Fighter90/career-ops-ui (61 stars, last pushed yesterday), licensed MIT. It adds 65 tokens to every session and 1,349 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
version-release
Choose and apply the correct semantic version bump for this repository. Use for every user-visible release, before merge when a change set should ship as patch, minor, or major, and whenever package/plugin/desktop version metadata must stay synchronized.
release-guard
Run release-readiness checks for this repository. Use when validating docs, scripts, verification coverage, and operational safety before merge or release.
pull-request
Use this whenever the user asks to "open a PR", "ship this", "create the pull request", "make a PR", or once a feature/fix is verified and ready to push. Full lifecycle: branch → commit (commitizen) → issue → draft PR → CI → ready → autonomous monitor loop (fix comments, resolve threads, iterate until CI green + zero…
ship
MANUAL TRIGGER ONLY: invoke only when user types /ship. Ship workflow: detect + merge base branch, run tests, review diff, bump VERSION, update CHANGELOG, commit, push, create PR. Use when asked to "ship", "deploy", "push to main", "create a PR", or "merge and push". Proactively suggest when the user says code is…
document-release
MANUAL TRIGGER ONLY: invoke only when user types /document-release. Post-ship documentation update. Reads all project docs, cross-references the diff, updates README/ARCHITECTURE/CONTRIBUTING/CLAUDE.md to match what shipped, polishes CHANGELOG voice, cleans up TODOS, and optionally bumps VERSION. Use when asked to…
agent-release-swarm
Agent skill for release-swarm - invoke with $agent-release-swarm.