A pre-merge checklist for a pull request, which is a proposed set of code changes submitted for review. It checks code quality, tests, builds, CI, documentation, AWS cleanup, and review readiness.

It is for running the full verification process before creating or merging a pull request.

It reduces the chance of merging changes that fail checks or leave behind resources, especially when command output could hide failures.

How go-to-k/cdkd configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to go-to-k/cdkd. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/go-to-k/cdkd/main/.claude/skills/verify-pr/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/go-to-k/cdkd

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/go-to-k/cdkd/verify-pr/github.svg)](https://agentmods.dev/skills/go-to-k/cdkd/verify-pr)

Your own site

<a href="https://agentmods.dev/skills/go-to-k/cdkd/verify-pr"><img src="https://agentmods.dev/badge/skills/go-to-k/cdkd/verify-pr/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/go-to-k/cdkd/verify-pr"><img src="https://agentmods.dev/badge/skills/go-to-k/cdkd/verify-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 29 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,172 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Agent Snooping · line 132
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00029	$0.02172
Opus 5.5	$0.00012	$0.00869
Sonnet 5.5	$0.00006	$0.00434
Haiku 4.5	$0.00003	$0.00217

Measured 3d ago against content hash 30eecb6b336a, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

verify-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/verify-pr/SKILL.md · 169 lines

How it starts

The opening of the file, as written. The whole thing — 169 lines — stays where its author put it; the contents beside it link to each section on GitHub.

PR Readiness Verification

Heavy pre-merge check, before creating or merging a PR — NOT before every commit (that is /check). No hook or marker enforces it; the checklist still applies in full and is the recommended procedure before gh pr create / gh pr merge.

Steps 6, 8 and 10-12 live in references/*.md, read at the step that uses them.

Checklist

Run each check and report pass/fail:

Worktree pre-flight: mise trust, then [ -d node_modules ] || vp install. mise trust is unconditional — an untrusted .mise.toml makes every mise exec in this run die with a config-parse error naming no cause. A fresh worktree has no node_modules, so typecheck / lint / build / test all fail with tsc: command not found, easy to miss when output is piped to tail (the exit code is tail's). Do not start step 1 until this passes.
Code quality — /check steps 1-3, which this skill supersedes.
- vp run check (CI's exact command: typecheck + lint + Prettier; lint alone skips Prettier), vp run typecheck:test (the only gate covering tests/**), vp run build — all pass.
- When piping to tail / head / grep, check the output CONTENT for Error / Command failed: $? after a pipeline reflects the last stage. When in doubt: out=$(mktemp); vp run X > "$out" 2>&1; rc=$?; tail -3 "$out"; echo "[rc=$rc]".
Tests
- vp test run — all unit tests pass (preferred over vp run test; /check step 4 has the rationale). Report the test count.
- Every scope / diff check in this skill uses origin/main...HEAD, never main...HEAD — the integ-destroy gate derives its scope from origin/main, so an unfetched local main makes this skill and the merge-blocking gate disagree about what the branch touched.
- Test coverage check: compare the diff's src/ changes against its tests/ changes; new or modified logic with no test update is a FAIL.
CI status
- PR number: argument, else gh pr view --json number -q .number, else ask via AskUserQuestion.
- FIRST: gh pr view <PR> --json mergeStateStatus,mergeable. At mergeable=CONFLICTING state=DIRTY the CI workflow NEVER fires, however long you wait, and neither close+reopen nor a force-push of unchanged content re-triggers it. Resolution: git fetch origin main && git merge origin/main, resolve, push (no force).
- Only once the state is CLEAN / UNSTABLE / BLOCKED / BEHIND: gh pr checks <PR> — all pass; if pending, wait and recheck.

Read the full file on GitHub · 169 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago Changed 30eecb6b336a
5d ago Changed d57bfba3300c
9d ago Changed 9684e6f68dc5
1mo ago Changed 36449bba2f46
1mo ago Changed · -1 lines 4288bfc144a0
1mo ago Changed · -28 lines 011015e1e4cb
1mo ago Changed · -30 lines 881ee866650a
1mo ago Changed · +9 lines 6de45371bb3b
1mo ago Changed · -200 lines cf85d2f5d36e
1mo ago First seen · 419 lines · 29 tokens per session scan A 83db48a31864

Subscribe to this mod's changes

verify-pr is a skill published in the GitHub repository go-to-k/cdkd (156 stars, last pushed today), licensed Apache-2.0. It adds 29 tokens to every session and 2,172 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review Testing aws aws-cdk aws-cloudformation awscdk cdk cloudformation

testing-patterns

Skill "testing-patterns" from seandkendall/kiro-config, covering testing patterns, python lambda test (pytest + moto), react component test (vitest + rtl), coverage commands and playwright quick reference.

seandkendall/kiro-config · 40 tokens

aws-cdk-mcp-server-mcp

AWS Cloud Development Kit (CDK) best practices, infrastructure as code patterns, and security compliance with CDK Nag.

Friz-zy/ai-capability-registry · 33 tokens

aws-testing

Testing strategies for AWS workloads. Use when writing unit tests, integration tests, contract tests, mocking AWS services, or setting up quality gates and CI/CD test pipelines.

eliecer2000/kiro-bootstrap · 36 tokens

python-runtime

Python toolchain configuration and best practices. Use when setting up Ruff, pytest, mypy type hints, dependency management, virtual environments or Python project standards.

eliecer2000/kiro-bootstrap · 34 tokens

prowler-test-api

Testing patterns for Prowler API: JSON:API, Celery tasks, RLS isolation, RBAC. Trigger: When writing tests for api/ (JSON:API requests/assertions, cross-tenant isolation, RBAC, Celery tasks, viewsets/serializers).

prowler-cloud/prowler · 62 tokens

adk-go-self-review

Review an ADK Go change the way a maintainer will — a fresh-context pass over the whole diff, five lenses (correctness and tests, scope, simplicity, style, adk-python parity), and the mutation check that proves your tests pin the change. Use before opening a PR, before any later push that changes code, and when asked…

google/adk-go · 87 tokens

cdkd: Skill for Claude Code