Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mergifyio/mergify-cli/mergify-stacknpx skills add Mergifyio/mergify-cli --skill mergify-stackgit clone --depth 1 https://github.com/Mergifyio/mergify-cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00079 | $0.04355 |
| Opus 5 | $0.00039 | $0.02178 |
| Sonnet 5 | $0.00016 | $0.00871 |
| Haiku 4.5 | $0.00008 | $0.00436 |
Grade A, and why
mergify-stack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 234 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mergify Stack Workflow
Stack Philosophy
A branch is a stack. Keep stacks short and focused:
- A stack should only contain commits that depend on each other
- Rationale: longer stacks take longer to merge
Proactive stack management:
- If an existing stack can be split into independent stacks, offer to do so
- When asked to do something new: if it can be done on a separate branch, either do so or ask if in doubt
- Default to creating a new branch for unrelated changes
Core Conventions
- Push: Use
mergify stack push(nevergit push) - Fixes: Use
git commit --amend(never create new commits to fix issues) - Amend notes: When amending a commit that already has a PR (i.e. has been pushed), attach a
mergify stack noteBEFOREmergify stack pushto record why the commit was amended. The note appears in the PR's "Revision history" comment and JSON marker, so reviewers can see the reason without diffing. - Mid-stack fixes: Stash any local changes first (
git stash -u), then usemergify stack edit <SHA-or-Change-Id-prefix>to pause the rebase at the target commit. Amend it withgit commit --amend, thengit rebase --continue, thenmergify stack push, thengit stash pop. Non-interactive — never usegit rebase -ifor this. (Callingmergify stack editwith no argument falls back to a fully interactivegit rebase -iand will hang in agent contexts — always pass a commit prefix.) - Reordering: Stash any local changes first (
git stash -u), then usemergify stack reorder(list all commits in desired order) ormergify stack move(move a single commit) instead of manualgit rebase -i— non-interactive and avoidsGIT_SEQUENCE_EDITORquoting issues - Fixup: Stash any local changes first (
git stash -u), then usemergify stack fixup <SHA>...to fold a commit into its parent (drops the listed commit's message). Non-interactive — never usegit rebase -ifor this. - Squash: Stash any local changes first (
git stash -u), then usemergify stack squash SRC... into TARGET [-m "msg"]to combine multiple commits into one, with an optional custom message. Non-interactive — never usegit rebase -ifor this. - Reword: Stash any local changes first (
git stash -u), then usemergify stack reword <SHA> -m "new message"to change a commit's message in place. Non-interactive when-mis given — never usegit rebase -ifor this. - Drop: Stash any local changes first (
git stash -u), then usemergify stack drop <SHA>...to remove commits from the stack. Non-interactive — never usegit rebase -ifor this. - Commit titles: Follow Conventional Commits (e.g.,
feat:,fix:,docs:) - PR title & body:
mergify stackcopies the commit message title to the PR title and the commit message body to the PR body — so write commit messages as if they were PR descriptions. Everything that should appear in the PR (ticket references, context, test plans) MUST go in the commit message. - Ticket references: Include ticket/issue references (e.g.,
MRGFY-1234,Fixes #123) in the commit message body, not added separately to the PR. - PR lifecycle is fully managed by
mergify stack: NEVER edit PR titles, bodies, or labels withgh pr editor the GitHub MCP — they will be overwritten on the next push. NEVER close or merge PRs manually —mergify stackhandles the entire PR lifecycle (creation, updates, and cleanup). - Draft PRs: NEVER mark a PR as ready-for-review — all PRs stay as drafts. The user will manually move them out of draft after reviewing.
- Each commit must pass CI independently: Every commit in a stack becomes its own PR. Each PR runs CI separately, so every commit must be self-contained — it must compile, pass linters, and pass tests on its own without depending on later commits in the stack. When formatting or linting fixes are needed, they must be included in the commit that introduced the issue, not deferred to a later commit.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 234 lines · 79 tokens per session scan A 7db957f8cd81
mergify-stack is a skill published in the GitHub repository Mergifyio/mergify-cli (29 stars, last pushed 4d ago), licensed Apache-2.0. It adds 79 tokens to every session and 4,355 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nemoclaw-contributor-implement-issue
Implement an accepted NemoClaw GitHub issue in the current checkout. Use when a user asks to pick up an issue for implementation, implement or fix a named issue, or add the issue's tests. Confirm accepted scope, deliver the smallest independently valuable capability slice, and record validation and remaining gates…
amazon-bestseller-listing
Amazon Best Sellers listing scraper: extract product cards from any Amazon Best Sellers (zgbs) or /gp/bestsellers/ category page — returns rank (position on chart), asin, title, url, image, imageAlt, price, stars, reviewCount, ratingRaw per item, plus category metadata (categoryName, categoryFullName, categoryUrl) and…
amazon-reviews-api-skill
This skill helps users automatically extract Amazon product reviews via the Amazon Reviews API. Agent should proactively apply this skill when users express needs like getting reviews for Amazon product with ASIN B07TS6R1SF, analyzing customer feedback for a specific Amazon item, getting ratings and comments for a…
amazon-competitor-analyzer
Scrapes Amazon product data from ASINs using browseract.com automation API and performs surgical competitive analysis. Compares specifications, pricing, review quality, and visual strategies to identify competitor moats and vulnerabilities.
cabloy-worktree-environment
This skill must be used only when the user explicitly invokes /cabloy-worktree-environment or explicitly asks to perform the named Cabloy worktree-environment setup. It prepares a confirmation-gated, worktree-local Vona and Zova runtime environment for a linked Cabloy Basic or Cabloy Start Git worktree using Git…
shopify-hydrogen
Hydrogen storefront implementation cookbooks. Some of the available recipes are: B2B Commerce, Bundles, Combined Listings, Custom Cart Method, Dynamic Content with Metaobjects, Express Server, Google Tag Manager Integration, Infinite Scroll, Legacy Customer Account Flow, Markets, Partytown + Google Tag Manager…