Sui is a blockchain platform for running smart contracts and managing digital assets, using the Move programming language and a network of authorities to process transactions. It is intended for developers building web3 applications and on-chain assets.
Borrowing it
Nothing to install: this file belongs to MystenLabs/sui. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/MystenLabs/sui/main/.claude/skills/send-pr/SKILL.mdgit clone --depth 1 https://github.com/MystenLabs/suiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mystenlabs/sui/send-pr)<a href="https://agentmods.dev/skills/mystenlabs/sui/send-pr"><img src="https://agentmods.dev/badge/skills/mystenlabs/sui/send-pr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mystenlabs/sui/send-pr"><img src="https://agentmods.dev/badge/skills/mystenlabs/sui/send-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 116 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00018 | $0.02564 |
| Opus 5.5 | $0.00007 | $0.01026 |
| Sonnet 5.5 | $0.00004 | $0.00513 |
| Haiku 4.5 | $0.00002 | $0.00256 |
Grade A, and why
send-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prepare and send (or update) a pull request. Follow every step below in order. If any step fails trivially (lint warning, minor test fix, formatting), fix it and continue. If a failure is non-trivial (widespread test breakage, unclear intent), STOP and report the failure.
Step 0 — Determine GitHub username and base branch, verify commit authorship
Retrieve the GitHub username from git config:
GH_USER=$(git config github.user || gh api user -q .login)
Store this as $GH_USER — it is used for branch naming in later steps.
Determine the base branch for this PR. If a PR already exists, use its base branch. Otherwise, check if the branch was created from another feature branch (e.g. git log --oneline --graph or tracking info). Default to $BASE if unclear. Store this as $BASE — all subsequent steps that reference the upstream use $BASE instead of hardcoding $BASE.
Verify that the author and committer for every commit on this branch match the configured git identity:
EXPECTED_NAME=$(git config user.name)
EXPECTED_EMAIL=$(git config user.email)
git log $BASE..HEAD --format='%an%n%ae%n%cn%n%ce' | sort -u
Every name returned should equal $EXPECTED_NAME and every email should equal $EXPECTED_EMAIL. If any commit has a different author or committer, rewrite those commits using git rebase -x with git commit --amend --reset-author to align them with the configured identity. Do NOT use interactive rebase (-i).
Step 1 — Check for existing PR and ensure feature branch
First, check if there is an open PR for the current branch (gh pr view). Note the result — you will need it in Step 11. If a PR exists, use its base branch as $BASE.
Then ensure the branch name:
- If the current branch starts with
$GH_USER/, continue. - If on
main/master, create a new branch named$GH_USER/<short-description>based on the recent commit messages, switch to it, and continue. - If on another branch not prefixed with
$GH_USER/AND there is no open PR for it, rename it withgit branch -m $GH_USER/<current-name>. - If on another branch not prefixed with
$GH_USER/AND there IS an open PR, do not rename. Continue with the current name.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 163 lines · 18 tokens per session scan A 3d48c7b88a47
send-pr is a skill published in the GitHub repository MystenLabs/sui (7,784 stars, last pushed today), licensed Apache-2.0. It adds 18 tokens to every session and 2,564 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
blockchain-application
Use this skill when asked about smart contract development, Solidity, Vyper, Rust smart contracts (Solana, NEAR, Polkadot), Haskell/Plutus (Cardano), Cairo/StarkNet, dApp backend development, Truffle, Hardhat, Foundry, Anchor, and blockchain application patterns. Languages: Solidity, Vyper, Rust, Haskell, Cairo, Move.…
solidity-coding
Write and modify production Solidity contracts in Foundry projects. Use when writing a contract, implementing a function, adding errors, events, or structs, designing contract architecture, optimizing gas, hardening security, planning upgrades, or working in src/.
foundry-testing
Write and debug Foundry tests and Solidity scripts. Use when writing unit, fuzz, fork, or invariant tests, writing bulloak BTT .tree specs (Branching Tree Technique), using cheatcodes, benchmarking gas, measuring coverage, writing deploy scripts, or working in tests/ or script/.
lineth-quickstart
Operating manual for the Lineth Stack quickstart — the Docker-Compose dev/demo stack at docs/getting-started/lineth-stack in the lineth-monorepo that boots a local Linea/Lineth L2 with Sepolia or local L1 finality. Use whenever you are working inside the lineth-stack quickstart and need to boot or run the stack…
blockchain-expert
Expert-level blockchain, Web3, smart contracts, DeFi, and cryptocurrency development. Use when the user mentions Web3, smart contracts, DeFi, Ethereum, or Solidity, or when the task involves Blockchain Fundamentals, Web3 & DeFi, Smart Contract Security, or Gas Optimization.
web3-expert
Build production-ready Web3 applications including smart contracts, dApps, DeFi protocols, and decentralized storage solutions. Use when the user mentions Web3, smart contracts or Solidity, dApps, DeFi protocols, ethers.js or web3.js, IPFS, or on-chain integration with Ethereum-compatible networks.