Borrowing it
Nothing to install: this file belongs to jmrplens/gitlab-mcp-server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jmrplens/gitlab-mcp-server/main/.github/skills/upstream-contribution/SKILL.mdgit clone --depth 1 https://github.com/jmrplens/gitlab-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jmrplens/gitlab-mcp-server/upstream-contribution)<a href="https://agentmods.dev/skills/jmrplens/gitlab-mcp-server/upstream-contribution"><img src="https://agentmods.dev/badge/skills/jmrplens/gitlab-mcp-server/upstream-contribution/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jmrplens/gitlab-mcp-server/upstream-contribution"><img src="https://agentmods.dev/badge/skills/jmrplens/gitlab-mcp-server/upstream-contribution.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00096 | $0.18308 |
| Opus 5.5 | $0.00038 | $0.07323 |
| Sonnet 5.5 | $0.00019 | $0.03662 |
| Haiku 4.5 | $0.00010 | $0.01831 |
Grade A, and why
upstream-contribution scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 404 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Upstream contribution: GitLab projects on gitlab.com
Contribute bug fixes, missing endpoint wrappers, missing struct fields, API fixes and documentation corrections to the GitLab projects this server depends on or documents against: gitlab-org/api/client-go (the library), gitlab-org/gitlab (the monolith: the API, its OpenAPI and GraphQL documents, and doc/), and any other gitlab-org project a finding leads to.
Every rule below was read off the upstream project's own configuration, its triage automation, its merged history, or the 65 merge requests this account (jmrp on gitlab.com) opened in gitlab-org projects up to 2026-10-08 together with every discussion on them. The source is named beside each rule, and a count such as "(14 MRs)" says how often reviewers or bots raised it. Where two readings disagreed, the one that survived an adversarial pass is the one written here.
Ground rules for every write
These hold on every gitlab-org project, before anything else in this file.
- Ask first. Nothing is written on gitlab.com or to a fork without the maintainer's yes: no push, no merge request, no comment, no reply, no ready or label command, no applied suggestion, no issue edit. Read everything, lay out the state and the proposed writes as a list, and wait. A push to a community-fork branch counts, because it changes a merge request other people are reviewing. A subagent doing this work keeps branches local and posts nothing.
- A second, independent review before anything leaves. An Opus agent that did not write the artefact reviews the exact diff or text, with the thread it answers and this file, and is briefed to refute it: wrong facts, overclaims, tone, attribution lines, bare short references, em dashes, the target project's rules. Fix what survives, review again, then publish.
- Before each approved write, check it is not already done and copy how it was done before. A bot may already have requested the same reviewer, someone may have restarted the pipeline. Match the form of jmrp's own earlier notes on sibling merge requests.
- Pace. A recent upstream merge request gets at least one more day after its last activity before a nudge is even proposed. Do not fire a round of ready commands in one sitting (see "Small and topical, a few at a time"). A finished local fix is opened even when the project already has several of ours open (maintainer, 2026-10-08); only a real dependency (same files, a promised order or pace, such as client-go's a few at a time since !3063 closed) still waits.
- Never retry a pipeline on gitlab.com or in a community fork. Classify the failure once (infrastructure versus a job that reached
step_script), fix what is ours, report the rest. Maintainers start the canonical pipeline when they review (they said so on gitlab-org/gitlab!254699, !255702 and client-go!2996, !3048). - Texts. English, first person as the maintainer, plain and specific, no em dash, no AI attribution of any kind, no session or tool links. A merge request description is one paragraph per line with no hard wrap; a commit body is the opposite and wraps at 72 (see "Commit messages"). On gitlab.com use native references inside a description or a note; never put a reference in a commit message.
- Long descriptions keep a short visible summary and put the per-commit list, evidence and testing in
<details><summary>...</summary>blocks with a blank line after<summary>. Say the work comes from maintaining gitlab-mcp-server, and link upstream-bugs.md as the place the project records everything done on its dependencies and sibling projects. - GitLab Duo is a bot. A note in a Duo thread is written for the human reviewers: impersonal, what holds, what changed and why, no thanks, no addressing the bot. Resolving it stays with the human reviewer.
- The gitlab.com username is
jmrp, notjmrplens. Anauthor_usernamequery with the wrong one answers[], which reads as "no merge requests". - An upstream finding is answered with the fix where it belongs, a merge request upstream and, if our code adapts, a pull request here; never with an issue in this repository about somebody else's code.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +3 lines 4ebb1706998c
- 13d ago Changed · +142 lines · +56 tokens per session 7b4c9e3c88f3
- 24d ago Changed 06c12472857f
- 27d ago Changed · +6 lines 36eb5ab019fa
- 1mo ago Changed · +21 lines e42951978c1d
- 1mo ago Changed · +129 lines 77eaa16b7396
- 1mo ago Changed 8971c92eabdb
- 1mo ago Changed · +1 lines 2b6841c30ddb
- 1mo ago First seen · 102 lines · 40 tokens per session scan A 34032553166c
upstream-contribution is a skill published in the GitHub repository jmrplens/gitlab-mcp-server (46 stars, last pushed today), licensed MIT. It adds 96 tokens to every session and 18,308 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
goai
GoAI is a Go SDK for AI applications. One unified API across 25+ LLM providers. Inspired by the Vercel AI SDK, adapted to Go idioms (generics, interfaces, channels).
check-linters-before-commit
Before any commit, run linters, vet, tests, and build verification; do not commit until checks pass.
golang-benchmark
Run reproducible Go benchmarks, profiling, benchstat and CI regression analysis.
golang-observability
Instrument Go services using slog, OpenTelemetry, Prometheus and profiling.
crawlkit
Maintain and release the crawlkit Go library, preserving downstream compatibility for gitcrawl, slacrawl, discrawl, and notcrawl.
go-expert
Expert-level Go development with Go 1.22+ features, concurrency, standard library, and production-grade best practices. Use when the user mentions concurrency, microservices, or backend, or when the task involves idiomatic Go, goroutines and channels, context-based cancellation, or writing an HTTP server.