pull-request

pull-request is a skill for Claude Code from microsoft/hve-core. It costs 43 tokens per session (2,241 once invoked), scanned A, original, MIT.

A tool for preparing, creating, or updating a GitHub pull request, which is a proposed set of code changes submitted for review. It compares the branch changes, follows repository templates, and runs focused checks before external changes.

In plain words
What is it for?
Use it to turn the current branch into a review-ready pull request, make authorised preflight repairs, or update an existing request.
Why use it?
It reduces inaccurate pull-request descriptions and catches likely changed-area failures without automatically running every test.

Skill for Claude Code ✓ vendor

Written for Claude Code: user-invocable in frontmatter.

Good fit Use it to turn the current branch into a review-ready pull request, make authorised preflight repairs, or update an existing request.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/microsoft/hve-core/pull-request
About the project

HVE Core is a collection of agents, prompts, coding instructions, and skills for building repeatable software-development workflows with GitHub Copilot. It is intended for individuals and teams that want structured AI-assisted research, planning, implementation, and review, while the catalogue entries provide many of its reusable workflow components.

microsoft/hve-core · 1,437 stars · on GitHub

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add microsoft/hve-core --skill pull-request
Clone the repo
git clone --depth 1 https://github.com/microsoft/hve-core

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for pull-request

README.md
[![agentmods](https://agentmods.dev/badge/skills/microsoft/hve-core/pull-request.svg)](https://agentmods.dev/skills/microsoft/hve-core/pull-request)
Your own site
<a href="https://agentmods.dev/skills/microsoft/hve-core/pull-request"><img src="https://agentmods.dev/badge/skills/microsoft/hve-core/pull-request.svg" alt="Measured on agentmods" height="20"></a>
Per session 43 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,241 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00043 $0.02241
Opus 5 $0.00022 $0.01120
Sonnet 5 $0.00009 $0.00448
Haiku 4.5 $0.00004 $0.00224

Measured yesterday against content hash 73db74d45d79, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

pull-request scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/Collect-Context.ps1, scripts/collect-context.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/skills/hve-core/pull-request/SKILL.md · 173 lines

How it starts

The opening of the file, as written. The whole thing — 173 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Pull Request

Goal

Turn the current branch into a review-ready GitHub pull request with a short, accurate description and enough targeted local evidence to catch likely CI failures without running broad validation by default.

Success means the title and body reflect the committed branch diff, the repository template is preserved when present, changed-area preflight checks pass, any authorized preflight repairs are committed under repository conventions, and an external pull request is created or updated only after one final approval.

Inputs

  • base: Base branch or ref. Default to the remote default branch without fetching.
  • draft: Whether a newly created pull request is a draft. Default to false.
  • action: prepare, create, or update. Infer from the request and default to prepare when external write intent is unclear.

Use the current checked-out branch as the head. Ask only for an input that cannot be inferred and changes the resulting pull request.

Flow

  1. Run the platform-matching script in scripts/ to collect branch, commit, changed-file, diff-stat, working tree, base-divergence, and template context. Preserve the initial working-tree state as the exclusion boundary for later repairs. The script uses the local remote-tracking ref and does not fetch, merge, rebase, push, or edit the branch.
  2. Stop if the repository, head branch, base ref, or merge base cannot be resolved. If the branch has no committed changes from the merge base, report that there is nothing to submit. Treat uncommitted files as excluded from the pull request and ask whether to continue only when the user's intent appears to include them. Before an external write, stop with sync guidance when the reported upstream push state is behind or diverged.
  3. Inspect the committed diff from the reported merge base. Start with changed files and diff stats, then read the diffs that determine reviewer-visible behavior. Group related files and use delegation only when a large, separable diff would materially benefit from isolated review.
  4. Derive the title from the branch and commits. Follow the repository's title convention when one exists; otherwise use a concise imperative title. Extract closing issue references only when they appear in branch or commit evidence.
  5. Build .copilot-tracking/pr/pr.md. Use the discovered repository template and preserve its heading order, comments, and manual-review checkboxes. If no template exists, copy templates/pull-request.md. Replace instructional placeholders with verified content while keeping unsupported human attestations unchecked. Apply any repository instructions that match the pull request artifact.
  6. Write for a human reviewer. Open with one plain-language summary, group the material changes by reviewer concern, and include only evidence-backed impact, compatibility, security, migration, testing, and follow-up details. Omit empty optional sections in the fallback template. Avoid a commit transcript, exhaustive file inventory, implementation chronology, and claims not supported by the diff or commits.
  7. Apply the public-output guard from the applicable content-policy instructions. Do not copy private classifications, sensitive values, or raw suspect content into the pull request body.
  8. Run the CI-confidence gate. Always run git diff --check against the committed branch diff, then match changed paths against workflow triggers and select the smallest non-mutating checks that own those areas from package scripts, path-scoped instructions, and the matching workflow steps. Prefer focused tests, syntax checks, check-mode generators, and artifact validators. Do not run full validation aggregates or CI-prefixed wrappers unless the user explicitly requests them. When a matching workflow calls a CI-prefixed wrapper, run its locally safe non-mutating component checks if no equivalent local-safe package command exists; the prefix alone is not a reason to skip them. Do not infer browser suites, service-dependent tests, security scans, or other lane-specific prerequisites from this component-check rule. Follow repository dependency bootstrap rules before dependency-backed commands.
  9. Record only checks that actually ran in the pull request. Leave hosted CI checks and human review attestations unchecked. If a required targeted check fails, keep the prepared description and stop before external creation or update. Do not change branch source unless the user asks for a fix.
  10. When the user asks to fix a local test or CI-confidence failure, treat that request as authority to commit only the resulting validated repairs. Capture the tracked and untracked working-tree baseline before editing, apply the smallest in-scope correction, and rerun every check affected by it. After the checks pass, resolve the repository's applicable commit instructions, stage only the exact repair delta created by this workflow, inspect the staged diff, and create one or more logical commits. Use Conventional Commits when the repository requires them; otherwise use its stated convention or a concise imperative subject. Never stage pre-existing edits, unrelated changes, validation logs, or the pull request body. If the repair cannot be separated safely, commit authority is unclear, or the commit fails, stop before push or pull request write. Do not amend, squash, rebase, or create an empty commit unless the user explicitly requests it.
  11. After a repair commit, rerun the context collector and refresh the committed diff, title, body, validation evidence, divergence, and push state. For prepare, return the proposed title, body path, base and head branches, repair commits, divergence, and preflight result. For create or update, also search for an open pull request with the same head and base, then present the final title, body path, target, draft state, repair commits, validation result, and upstream push state. Ask once for approval covering any needed push and the pull request write.
  12. After approval, push the current branch when needed and use the available GitHub integration to create or update the pull request. Never force-push. If an open pull request already exists, update it only when the requested action permits; otherwise return its URL instead of creating a duplicate.

Read the full file on GitHub · 173 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 173 lines · 43 tokens per session scan A 73db74d45d79

Subscribe to this mod's changes

pull-request is a skill published in the GitHub repository microsoft/hve-core (1,437 stars, last pushed today), licensed MIT. It adds 43 tokens to every session and 2,241 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.