github-pr-workflow

github-pr-workflow is a skill for Claude Code from HezaoHezao/poirot. It costs 20 tokens per session (1,243 once invoked), scanned C, original, MIT.

A guide to the GitHub pull request process, where proposed code changes are reviewed before they are merged into a project. It covers branches, commits, publishing changes, pull requests, and automated checks.

In plain words
What is it for?
Use it to create a feature branch, commit and push changes, open a pull request, and inspect its continuous-integration results.
Why use it?
It provides commands for moving a change from local code to a reviewable GitHub pull request and checking whether tests or other checks pass.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: built for hermes-agent.

Good fit Use it to create a feature branch, commit and push changes, open a pull request, and inspect its continuous-integration results.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/hezaohezao/poirot/github-pr-workflow
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add HezaoHezao/poirot --skill github-pr-workflow
Clone the repo
git clone --depth 1 https://github.com/HezaoHezao/poirot

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for github-pr-workflow

README.md
[![agentmods](https://agentmods.dev/badge/skills/hezaohezao/poirot/github-pr-workflow/github.svg)](https://agentmods.dev/skills/hezaohezao/poirot/github-pr-workflow)
Your own site
<a href="https://agentmods.dev/skills/hezaohezao/poirot/github-pr-workflow"><img src="https://agentmods.dev/badge/skills/hezaohezao/poirot/github-pr-workflow/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for github-pr-workflow

Your own site · 80×15
<a href="https://agentmods.dev/skills/hezaohezao/poirot/github-pr-workflow"><img src="https://agentmods.dev/badge/skills/hezaohezao/poirot/github-pr-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 20 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,243 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00020 $0.01243
Opus 5.5 $0.00008 $0.00497
Sonnet 5.5 $0.00004 $0.00249
Haiku 4.5 $0.00002 $0.00124

Measured 1mo ago against content hash bc1c9a99de28, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

github-pr-workflow scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

curl -s "https://api.github.com/repos/$OWNER/$REPO/commits/$HEAD_SHA/check-runs" | python3 -c "

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

Complete guide for managing the PR lifecycle. `gh` first, `git` + `curl`
poirot/backend/agents/skill/builtin_skills/software-development/github-pr-workflow/SKILL.md · 191 lines

How it starts

The opening of the file, as written. The whole thing — 191 lines — stays where its author put it; the contents beside it link to each section on GitHub.

GitHub Pull Request Workflow

Complete guide for managing the PR lifecycle. gh first, git + curl fallback.

Prerequisites

  • Authenticated with GitHub (see github-auth skill)
  • Inside a git repository with a GitHub remote

1. Branch & Commit

# Create feature branch
git checkout -b feature/add-login

# Make changes, commit
git add -A
git commit -m "feat: add login endpoint"

# Push
git push -u origin feature/add-login

2. Create PR

# With gh (interactive)
gh pr create

# With gh (inline)
gh pr create \
  --title "feat: add login endpoint" \
  --body "## Changes
- Add /api/login route
- Add JWT token generation
- Add tests

## Testing
\`\`\`bash
pytest tests/test_auth.py -v
\`\`\`" \
  --base main \
  --head feature/add-login

# With curl
curl -s -X POST \
  -H "Authorization: token $GITHUB_TOKEN" \
  https://api.github.com/repos/$OWNER/$REPO/pulls \
  -d '{
    "title":"feat: add login endpoint",
    "body":"Add /api/login route with JWT",
    "head":"feature/add-login",
    "base":"main"
  }'

3. Check CI Status

# With gh
gh pr checks 42

# With curl (check runs)
curl -s "https://api.github.com/repos/$OWNER/$REPO/commits/$HEAD_SHA/check-runs" | python3 -c "
import sys, json
for r in json.load(sys.stdin)['check_runs']:
    print(f'{r[\"name\"]:30s} {r[\"conclusion\"] or r[\"status\"]}')
"

# With curl (statuses — legacy CI)
curl -s "https://api.github.com/repos/$OWNER/$REPO/commits/$HEAD_SHA/status" | python3 -c "
import sys, json
r = json.load(sys.stdin)
print(f'Overall: {r[\"state\"]}')
for s in r['statuses']:
    print(f'  {s[\"context\"]:30s} {s[\"state\"]}')
"

4. Update PR (push more commits)

# Make more changes
git add -A
git commit --fixup HEAD  # or regular commit
git push
# PR automatically updates

5. Review & Approve

# Request review
gh pr edit 42 --add-reviewer username

# Approve (as reviewer)
gh pr review 42 --approve --body "LGTM!"

# Request changes
gh pr review 42 --request-changes --body "See inline comments."

# Comment
gh pr review 42 --comment --body "Some suggestions."

Read the full file on GitHub · 191 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 191 lines · 20 tokens per session scan C bc1c9a99de28

Subscribe to this mod's changes

github-pr-workflow is a skill published in the GitHub repository HezaoHezao/poirot (251 stars, last pushed 2mo ago), licensed MIT. It adds 20 tokens to every session and 1,243 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

kirocrew-prepare-pr

LOAD THIS FOR EVERY KIRO CREW PR you open or update (Kiro Crew repo only; not other repos or CRs). Runs the whole loop — issue + tier, commit, sync, squash, push, drive CI and AI review to green, fix a red main, arm auto-merge and watch it land (24h). 'push my changes' = prepare-only.

kirodotdev/KiroCrew · 85 tokens

commit

Atomic git commit with conventional message. Use when the user says "commit", "save my changes", "commit this", or wants to create a git commit. Stages specific files, writes a conventional commit message with body explaining non-obvious decisions. Never uses git add -A.

congchuanling-dot/Cohort · 59 tokens

secret-leak-preflight

Use when about to commit, push, or publish -- staged changes touch config or environment files, generated artifacts (relay sessions, logs, build output) are being added, or the session handled credentials even indirectly.

yeaight7/agent-powerups · 48 tokens

release-notes

Draft a release note section from a commit range, grouped by what the reader gets.

kirodotdev/KiroCrew · 21 tokens

ship-change

Ship an OpenSpec change after openspec-apply completes. When only QA/manual tasks remain, marks them done (tested later), archives + syncs specs, commits, pushes, opens a PR against develop, watches CI, waits for CodeRabbit, auto-applies safe fixes and re-pushes, loops until CI green + no actionable review threads…

BlackBeltTechnology/pi-agent-dashboard · 129 tokens

akigitcommit

Analyze the working tree and commit changes in clean logical groups. Triages a long half-finished tree first (finished vs mid-edit vs abandoned vs accidental) before grouping. Auto-detects CHANGELOG to switch between domain-grouped mode (3–5 commits by object/feature) and type-grouped mode (feat/fix/refactor). Stages…

lacvietanh/akidevrule · 100 tokens