Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nearform/lastlight/pr-commentnpx skills add nearform/lastlight --skill pr-commentgit clone --depth 1 https://github.com/nearform/lastlightWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nearform/lastlight/pr-comment)<a href="https://agentmods.dev/skills/nearform/lastlight/pr-comment"><img src="https://agentmods.dev/badge/skills/nearform/lastlight/pr-comment.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00041 | $0.00726 |
| Opus 5 | $0.00020 | $0.00363 |
| Sonnet 5 | $0.00008 | $0.00145 |
| Haiku 4.5 | $0.00004 | $0.00073 |
Grade A, and why
pr-comment scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
GitHub operations via `github_*` MCP tools only — never `gh` CLI, `curl`, or raw HTTP. How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PR Comment
A maintainer @mentioned the bot on a PR with a question (not a request to write code, and not "review this"). The question is the entire job — answer it with evidence, in one comment. Examples: "does this consider X?", "why did we change Y?", "is the new function thread-safe?", "regression risk for existing callers?".
For general issue questions use issue-comment; for a full review use
pr-review.
Procedure
1. Read the PR and the question
github_get_pull_request→ title, body, base, head.prNumberin the Context block is your target — go straight there. Do not callgithub_list_pull_requeststo "find" or "confirm" it; you were handed it, and listing dumps every open PR for nothing.- The triggering question is in
context.commentBody. Answer that question — don't generalise to a review or answer a different one.
2. Investigate with the diff in hand
Get the diff and read the code needed to answer well — a real answer about thread-safety or regression risk needs the surrounding code, not just the hunk.
- Cap: 8 file reads per invocation.
- "Does it consider X?" → also check whether tests in the diff cover X.
- "Regression risk?" → find callers of any function whose signature/behaviour
changed (
github_search_code). - Don't clone the repo unless a single answer genuinely needs cross-file traces
no MCP tool can give — most don't. If it truly needs a full audit, say so and
recommend
@last-light(which routes topr-review) rather than blowing the cap.
3. Reply with one comment
github_add_issue_comment (PRs accept issue comments here). Keep it tight:
- Lead with the answer — yes / no / it depends. Don't bury it.
- Cite
path:line— clickable in the GitHub UI. - 3–8 sentences or a short bulleted list. No headings.
- If it's unanswerable from the PR alone, say so and name the specific information you'd need.
Yes —
src/foo.ts:42checksXbefore callingbar(), andtests/foo.test.ts:118asserts the rejection path. The only place X isn't validated is the legacybarLegacy(src/foo.ts:67), which this PR doesn't touch — worth a separate issue if you want it covered.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 68 lines · 41 tokens per session scan A 42c7e4865eb7
pr-comment is a skill published in the GitHub repository nearform/lastlight (22 stars, last pushed 7d ago), licensed MIT. It adds 41 tokens to every session and 726 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
github
Prepare GitHub issues, pull requests, reviews, and release notes for Zhin projects. Use when asked to write an issue, PR description, changelog entry, or review comment. Triggers: 写 issue, PR 描述, 提 PR, release notes, gh pr.
example-skill
Counts lines, words, and bytes in a text file using the bundled count.sh script. Use when asked to count/measure a file's size in these terms.
add_repo_inst
Please browse the current repository under /workspace/{{ REPOFOLDERNAME }}, look at the documentation and relevant code, and understand the purpose of this repository.
agent_sdk_builder
You are an expert requirements gatherer and agent builder. You must progressively interview the user to understand what type of agent they are looking to build. You should ask one question at a time w.
add_agent
This agent helps create new microagents in the .openhands/microagents directory by providing guidance and templates.
address_pr_comments
First, check the branch {{ BRANCHNAME }} and read the diff against the main branch to understand the purpose.