Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LerianStudio/ring --skill opening-pull-requestsgit clone --depth 1 https://github.com/LerianStudio/ringWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lerianstudio/ring/opening-pull-requests)<a href="https://agentmods.dev/skills/lerianstudio/ring/opening-pull-requests"><img src="https://agentmods.dev/badge/skills/lerianstudio/ring/opening-pull-requests/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lerianstudio/ring/opening-pull-requests"><img src="https://agentmods.dev/badge/skills/lerianstudio/ring/opening-pull-requests.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 211 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.02395 |
| Opus 5.5 | $0.00033 | $0.00958 |
| Sonnet 5.5 | $0.00017 | $0.00479 |
| Haiku 4.5 | $0.00008 | $0.00239 |
Grade A, and why
ring:opening-pull-requests scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 292 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Open a GitHub Pull Request against the correct base branch, with a title that will pass scope validation and a body that fills the repo's PR template. Verifies the base after creation and corrects it automatically if GitHub defaulted to the wrong target.
⛔ HARD STOP — DO NOT CALL gh pr create BEFORE COMPLETING STEPS 1–6
Skipping detection steps is how PRs end up targeting main when the repo expects develop, or how PRs fail validation due to a missing or invalid scope. MUST complete every step in order.
Step 1 — Detect Base Branch
NEVER assume the base. Run all three probes first, then apply the precedence rules below.
Probes (run in parallel)
# Probe A — GitHub API default
gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name'
# Fallback if gh unavailable: git remote show origin | grep 'HEAD branch' | awk '{print $NF}'
# Probe B — PR template hint
# Read .github/pull_request_template.md — note any explicit branch name mentioned
# Probe C — develop branch existence
git ls-remote --heads origin develop
Precedence (apply in order — first match wins)
| Priority | Source | Rule |
|---|---|---|
| 1 — highest | PR template | If .github/pull_request_template.md explicitly names a target branch, use it. Overrides everything. |
| 2 | develop exists + user confirms | If Probe C finds develop AND it differs from Probe A, show both options and ask the user to confirm. Use the user's choice. |
| 3 — fallback | GitHub API default | Use the value from Probe A. |
| 4 | Neither detected | STOP — ask the user which branch to target. |
State the resolved $BASE and which source determined it before proceeding.
Step 2 — Detect Scope Policy
MUST detect the allowlist before proposing the PR title. A title with a wrong or missing scope will fail PR validation and block the merge.
2.1 — Locate the policy file
Check in this order:
.github/workflows/pr-validation.yml(primary).github/workflows/pr-title.yml.github/workflows/commitlint.yml.github/workflows/semantic-pull-request.yml- Root configs:
commitlint.config.{js,cjs,mjs,ts},.commitlintrc*
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 292 lines · 83 tokens per session scan A 3da8e5129d0b
ring:opening-pull-requests is a skill published in the GitHub repository LerianStudio/ring (217 stars, last pushed 5d ago), licensed Apache-2.0. It adds 83 tokens to every session and 2,395 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review
Structured code review with parallel audit agents, confidence-scored triage, and optional auto-fix. Examines uncommitted changes, staged diffs, commit ranges, or specific paths. Produces a tiered report (MUST-FIX / RECOMMENDED / NIT) backed by evidence, then optionally applies fixes with verification.
incident
Incident response and postmortem generation from git/deploy context. When something breaks in production, this skill builds a timeline, identifies the probable cause, and generates a structured postmortem document. Flags: --since, --service, --sev, --revert, --comms, --dry-run.
worktree
Isolate work in a git worktree. Activates when the user needs branch isolation before executing a plan, wants a clean environment for a feature, is ready to finish work in an existing worktree, or wants to reclaim worktrees that accumulated and are now polluting filesystem-level measurement.
refactor-radar
Select refactor candidates with immutable git measurements, evidence-backed module families and temporary collision checks. Use for ranked refactor/test-debt triage, not implementation. DISCOVER saves reports without changing product code; REGISTER requires validated decisions. Worktree names are hints, test LOC is…
canary
Post-deploy monitoring with browser or degraded HTTP mode. Checks console errors, performance, page load. Configurable duration (1m-30m) and interval. Reports HEALTHY/DEGRADED/BROKEN. Flags: --duration, --interval, --quick, --max-errors.
release-docs
Diff-driven documentation sync after a release. Determines what source files changed, delegates changelog to zuvo:docs, updates only docs whose source changed. Flags: --dry-run, explicit range argument.