Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hani-q/qstack --skill qstack-prgit clone --depth 1 https://github.com/hani-q/qstackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hani-q/qstack/qstack-pr)<a href="https://agentmods.dev/skills/hani-q/qstack/qstack-pr"><img src="https://agentmods.dev/badge/skills/hani-q/qstack/qstack-pr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hani-q/qstack/qstack-pr"><img src="https://agentmods.dev/badge/skills/hani-q/qstack/qstack-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00137 | $0.02084 |
| Opus 5.5 | $0.00055 | $0.00834 |
| Sonnet 5.5 | $0.00027 | $0.00417 |
| Haiku 4.5 | $0.00014 | $0.00208 |
Grade A, and why
qstack-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 170 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/qstack-pr
An agent writes a forty-file change in ten minutes and a person then spends an hour reading raw diffs to work out what happened and whether to trust it. This skill spends the agent's time instead of the reviewer's: it writes the explanation a careful author would have written, from evidence, and then asks whether to open the pull request.
Two rules govern everything below.
- Nothing is claimed. Every sentence in the handoff traces to the diff, the git log, a file read in full, or a command run in this session. A test that was not run is not "passing". A commit order that was not read is not "test-first". A section with no evidence says so or is left out.
- Opening a pull request is publishing. It happens once, at the end, after the user has seen the exact title and body and answered the question. It never happens on the way.
1. Resolve the scope
Take the scope the way /qstack-review does. A named pull request, otherwise
this branch against the merge base with its base branch, otherwise the working
tree. Use the remote copy of the base branch when one exists, fetched first; a
local main can sit behind the branch's own history and give a merge base
that is wrong. Name the base branch and the head commit before reading
anything and put both in the handoff. Ask when two bases are equally
plausible.
When the branch already has an open pull request, the job is to rewrite its body, not to open a second one. Say so in the final question.
2. Check the branch is shippable
Stop and report, instead of writing a handoff over a broken branch, when any of these hold:
- No commits above the base. There is nothing a reviewer could see, so say that rather than describing work that has not been committed.
- Uncommitted or untracked files inside the scope. A handoff describes
commits; work that is not committed is not part of what a reviewer will see.
Name the files, so the author can tell a forgotten
git addfrom work that is genuinely unfinished. - A QStack plan folder for this work with cards still
claimedorin_progress, or areviewepic gate card that has not closed. The loop is not finished. - The repository's own landing rules are unmet. Read
AGENTS.md,CLAUDE.md,CONTRIBUTING.md, and any pull request template under.github/for what a branch must carry before it lands: a changelog entry, a version bump, a generated file kept in sync, a check script that must pass. Run the ones that can be run. Name each unmet rule and the line it came from.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 170 lines · 137 tokens per session scan A afe1da8590d3
qstack-pr is a skill published in the GitHub repository hani-q/qstack (7 stars, last pushed 3d ago), licensed MIT. It adds 137 tokens to every session and 2,084 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-17.
Other skills, from other repositories
pr
Draft a PR body from OMC's paper trail — the smallest visual that proves the change, evidence consumed from the verify protocol (never re-collected), reversibility from the ADR test on the diff, glossary language throughout.
merge-batch
Prepare and merge an owner-selected PR batch with contributor credit and exact-candidate admission. Use for a pasted PR list; combined focused validation is diagnostic, and every actual landing still requires its applicable checks and authorization.
otto-pr-review-loop
Run Polly and OCR on a PR until all findings settle.
engram-branch-pr
PR creation workflow for Engram following the issue-first enforcement system. Trigger: When creating a pull request, opening a PR, or preparing changes for review.
github-contributor
A step-by-step guide for contributing code, tests, documentation, or build changes to open-source projects you do not maintain. It explains how to prepare a pull request that follows the project’s rules and is easier for maintainers to review.
revdiff
Review diffs, files, and documents with inline annotations in a TUI overlay, or answer questions about revdiff usage, configuration, themes, and keybindings. Opens revdiff in agterm/tmux/zellij/herdr/kitty/wezterm/cmux/ghostty/iterm2/emacs-vterm, captures annotations, and addresses them. Works in git, hg, and jj repos…