HVE Core is a collection of agents, prompts, coding instructions, and skills for building repeatable software-development workflows with GitHub Copilot. It is intended for individuals and teams that want structured AI-assisted research, planning, implementation, and review, while the catalogue entries provide many of its reusable workflow components.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add microsoft/hve-core --skill pull-requestgit clone --depth 1 https://github.com/microsoft/hve-coreWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/microsoft/hve-core/pull-request)<a href="https://agentmods.dev/skills/microsoft/hve-core/pull-request"><img src="https://agentmods.dev/badge/skills/microsoft/hve-core/pull-request.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.02241 |
| Opus 5 | $0.00022 | $0.01120 |
| Sonnet 5 | $0.00009 | $0.00448 |
| Haiku 4.5 | $0.00004 | $0.00224 |
Grade A, and why
pull-request scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 173 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pull Request
Goal
Turn the current branch into a review-ready GitHub pull request with a short, accurate description and enough targeted local evidence to catch likely CI failures without running broad validation by default.
Success means the title and body reflect the committed branch diff, the repository template is preserved when present, changed-area preflight checks pass, any authorized preflight repairs are committed under repository conventions, and an external pull request is created or updated only after one final approval.
Inputs
base: Base branch or ref. Default to the remote default branch without fetching.draft: Whether a newly created pull request is a draft. Default tofalse.action:prepare,create, orupdate. Infer from the request and default topreparewhen external write intent is unclear.
Use the current checked-out branch as the head. Ask only for an input that cannot be inferred and changes the resulting pull request.
Flow
- Run the platform-matching script in
scripts/to collect branch, commit, changed-file, diff-stat, working tree, base-divergence, and template context. Preserve the initial working-tree state as the exclusion boundary for later repairs. The script uses the local remote-tracking ref and does not fetch, merge, rebase, push, or edit the branch. - Stop if the repository, head branch, base ref, or merge base cannot be resolved. If the branch has
no committed changes from the merge base, report that there is nothing to submit. Treat
uncommitted files as excluded from the pull request and ask whether to continue only when the
user's intent appears to include them. Before an external write, stop with sync guidance when the
reported upstream push state is
behindordiverged. - Inspect the committed diff from the reported merge base. Start with changed files and diff stats, then read the diffs that determine reviewer-visible behavior. Group related files and use delegation only when a large, separable diff would materially benefit from isolated review.
- Derive the title from the branch and commits. Follow the repository's title convention when one exists; otherwise use a concise imperative title. Extract closing issue references only when they appear in branch or commit evidence.
- Build
.copilot-tracking/pr/pr.md. Use the discovered repository template and preserve its heading order, comments, and manual-review checkboxes. If no template exists, copytemplates/pull-request.md. Replace instructional placeholders with verified content while keeping unsupported human attestations unchecked. Apply any repository instructions that match the pull request artifact. - Write for a human reviewer. Open with one plain-language summary, group the material changes by reviewer concern, and include only evidence-backed impact, compatibility, security, migration, testing, and follow-up details. Omit empty optional sections in the fallback template. Avoid a commit transcript, exhaustive file inventory, implementation chronology, and claims not supported by the diff or commits.
- Apply the public-output guard from the applicable content-policy instructions. Do not copy private classifications, sensitive values, or raw suspect content into the pull request body.
- Run the CI-confidence gate. Always run
git diff --checkagainst the committed branch diff, then match changed paths against workflow triggers and select the smallest non-mutating checks that own those areas from package scripts, path-scoped instructions, and the matching workflow steps. Prefer focused tests, syntax checks, check-mode generators, and artifact validators. Do not run full validation aggregates or CI-prefixed wrappers unless the user explicitly requests them. When a matching workflow calls a CI-prefixed wrapper, run its locally safe non-mutating component checks if no equivalent local-safe package command exists; the prefix alone is not a reason to skip them. Do not infer browser suites, service-dependent tests, security scans, or other lane-specific prerequisites from this component-check rule. Follow repository dependency bootstrap rules before dependency-backed commands. - Record only checks that actually ran in the pull request. Leave hosted CI checks and human review attestations unchecked. If a required targeted check fails, keep the prepared description and stop before external creation or update. Do not change branch source unless the user asks for a fix.
- When the user asks to fix a local test or CI-confidence failure, treat that request as authority to commit only the resulting validated repairs. Capture the tracked and untracked working-tree baseline before editing, apply the smallest in-scope correction, and rerun every check affected by it. After the checks pass, resolve the repository's applicable commit instructions, stage only the exact repair delta created by this workflow, inspect the staged diff, and create one or more logical commits. Use Conventional Commits when the repository requires them; otherwise use its stated convention or a concise imperative subject. Never stage pre-existing edits, unrelated changes, validation logs, or the pull request body. If the repair cannot be separated safely, commit authority is unclear, or the commit fails, stop before push or pull request write. Do not amend, squash, rebase, or create an empty commit unless the user explicitly requests it.
- After a repair commit, rerun the context collector and refresh the committed diff, title, body,
validation evidence, divergence, and push state. For
prepare, return the proposed title, body path, base and head branches, repair commits, divergence, and preflight result. Forcreateorupdate, also search for an open pull request with the same head and base, then present the final title, body path, target, draft state, repair commits, validation result, and upstream push state. Ask once for approval covering any needed push and the pull request write. - After approval, push the current branch when needed and use the available GitHub integration to create or update the pull request. Never force-push. If an open pull request already exists, update it only when the requested action permits; otherwise return its URL instead of creating a duplicate.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 173 lines · 43 tokens per session scan A 73db74d45d79
pull-request is a skill published in the GitHub repository microsoft/hve-core (1,437 stars, last pushed today), licensed MIT. It adds 43 tokens to every session and 2,241 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other skills, from other repositories
review-implement-phase
Implements triaged review actions, commits focused fixes, and posts Done plus resolves threads. Use when the user wants only the implementation phase of the review-framework workflow.
github-pr-workflow
Prepare a GitHub pull request from a feature branch — branch hygiene, commit shape, title/body, verification notes, screenshots for UI work, and replies to review comments.
review-delta
Review only changes since last commit using impact analysis. Token-efficient delta review with automatic blast-radius detection.
work-unit-commits
Plan commits as reviewable work units. Trigger: implementation, commit splitting, chained PRs, or keeping tests and docs with code.
github-contributor
End-to-end playbook for shipping high-quality pull requests to open-source projects you don't maintain — discovery, CONTRIBUTING compliance, PR-size check, minimal-diff implementation, PR description with AI-assisted disclosure, conflict resolution, and post-submission maintainer interaction. Use whenever creating…
pr-pending-feedback
Evaluate pending (unsubmitted) review comments on the current branch's PR and, after user confirmation, address each in a separate sub-agent and separate commit.