gh-treasure-hunt

gh-treasure-hunt is a skill for Claude Code, Codex from Hmbown/CodeWhale. It costs 39 tokens per session (1,190 once invoked), scanned A, original, MIT.

A workflow for searching an issue and pull-request queue, then ranking the safest and most valuable work to handle first.

In plain words
What is it for?
It helps prioritize clean community pull requests, issues already solved by the branch, small fixes, and larger work that should wait.
Why use it?
It helps maintainers find worthwhile contributions and quick fixes in a crowded queue without relying only on titles or labels. It recommends actions but does not merge or close items.

Skill for Claude CodeCodex

Which agent this was written for is unclear — built for codewhale. Also seen: built for codewhale.

Good fit It helps prioritize clean community pull requests, issues already solved by the branch, small fixes, and larger work that should wait.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/hmbown/codewhale/gh-treasure-hunt
About the project

Hmbown/CodeWhale is an open-source coding agent that runs in the terminal and is written in Rust. Developers use it to inspect repositories, edit files, run commands, and coordinate work with configurable model providers, skills, MCP servers, and approval controls; the catalogue entries extend its available workflows.

Hmbown/CodeWhale · 40,914 stars · on GitHub · codewhale.net

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add Hmbown/CodeWhale --skill gh-treasure-hunt
Clone the repo
git clone --depth 1 https://github.com/Hmbown/CodeWhale

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for gh-treasure-hunt

README.md
[![agentmods](https://agentmods.dev/badge/skills/hmbown/codewhale/gh-treasure-hunt/github.svg)](https://agentmods.dev/skills/hmbown/codewhale/gh-treasure-hunt)
Your own site
<a href="https://agentmods.dev/skills/hmbown/codewhale/gh-treasure-hunt"><img src="https://agentmods.dev/badge/skills/hmbown/codewhale/gh-treasure-hunt/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for gh-treasure-hunt

Your own site · 80×15
<a href="https://agentmods.dev/skills/hmbown/codewhale/gh-treasure-hunt"><img src="https://agentmods.dev/badge/skills/hmbown/codewhale/gh-treasure-hunt.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 39 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,190 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • Snyk warn 7 Sept 2026
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 1 finding, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Anti-Refusal · line 84
    Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
    Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00039 $0.01190
Opus 5 $0.00019 $0.00595
Sonnet 5 $0.00008 $0.00238
Haiku 4.5 $0.00004 $0.00119

Measured 8d ago against content hash 8d88d268e95f, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

gh-treasure-hunt scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

docs/skills/gh-treasure-hunt/SKILL.md · 102 lines

How it starts

The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.

gh-treasure-hunt

Hunt the open queue for the highest value-over-risk wins fast: clean focused community PRs, issues the branch already implements, and safe quick-fixes. Output a ranked action list with credit handling. Never act on title or labels alone, and never merge/close/tag without Hunter's approval.

When to use

  • You want to land the most contributor value with the least risk before a cut (example goal: maximize NEW contributors landed before a release).
  • The PR/issue queue is crowded and you need a triaged, prioritized hit list.

Ranking (value x safety, high to low)

  1. Clean direct-merge community PR, especially a NEW contributor's first PR.
  2. Issue the landing branch already implements -> close-with-evidence + credit.
  3. Genuinely small quick-fix (typo, doc, one-liner, missing test).
  4. Larger/design work -> defer with a note; do not chase here.

Workflow

  1. Pull the queue (read everything, decide nothing yet):
    gh pr list --repo Hmbown/CodeWhale --state open --limit 200 \
      --json number,title,author,headRefName,baseRefName,isDraft,mergeable,mergeStateStatus,additions,deletions,changedFiles,reviewDecision,labels,url
    gh issue list --repo Hmbown/CodeWhale --state open --limit 300 \
      --json number,title,author,labels,milestone,url
    
  2. Shortlist PRs that look CLEAN + small (mergeable=MERGEABLE, low changedFiles/additions, not draft, no trust-boundary surface: auth, sandbox, install, publish, branding). Flag any NEW contributor for credit.
  3. Confirm each shortlisted PR from code, tests, comments, and checks:
    gh pr view N --repo Hmbown/CodeWhale \
      --json files,commits,reviews,comments,statusCheckRollup,closingIssuesReferences
    gh pr checks N --repo Hmbown/CodeWhale
    
  4. Test mergeability against the REAL landing branch (release branches are often local-only; the main-based mergeable flag lies):
    git fetch origin pull/N/head:refs/tmp/pr-N
    base=$(git merge-base <release-branch> refs/tmp/pr-N)
    git merge-tree "$base" <release-branch> refs/tmp/pr-N   # empty/no conflict markers == clean
    
  5. Find already-implemented issues: grep the landing branch for the behavior the issue asks for, then confirm the exact lines.
    git grep -n "DEEPSEEK_BASE_URL" <release-branch>
    
    If the branch already covers it, draft a close-with-evidence note linking the commit/lines and crediting the reporter. Hold the close for approval.
  6. Spot quick-fixes: short issues/PRs that are a typo, doc nit, asset-name mismatch, or a single missing test. Keep them genuinely small.
  7. Build the credit plan per win. Cherry-pick preserves the author. Otherwise add trailers, using .github/AUTHOR_MAP first (else derive the noreply id):
    gh api users/HANDLE --jq '"\(.id)+\(.login)@users.noreply.github.com"'
    
    Co-authored-by: Name <[email protected]>
    Harvested from PR #N by @handle
    
    The Harvested from PR #N by @handle line lets auto-close-harvested.yml close the PR with credit once the commit reaches main. Validate trailers:
    git log BASE..HEAD --format='%h %an <%ae>%n%(trailers:key=Co-authored-by)'  # credit the human, from .github/AUTHOR_MAP
    
  8. Sanity-check anything you would actually land locally before recommending it:
    cargo fmt --all -- --check && cargo test --workspace
    

Read the full file on GitHub · 102 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago Changed 8d88d268e95f
  2. 11d ago First seen · 102 lines · 39 tokens per session scan A fb078b4908ee

Subscribe to this mod's changes

gh-treasure-hunt is a skill published in the GitHub repository Hmbown/CodeWhale (40,914 stars, last pushed 4d ago), licensed MIT. It adds 39 tokens to every session and 1,190 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories