Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add OpenHands/extensions --skill gitlab-issue-to-mrgit clone --depth 1 https://github.com/OpenHands/extensionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/openhands/extensions/gitlab-issue-to-mr)<a href="https://agentmods.dev/skills/openhands/extensions/gitlab-issue-to-mr"><img src="https://agentmods.dev/badge/skills/openhands/extensions/gitlab-issue-to-mr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/openhands/extensions/gitlab-issue-to-mr"><img src="https://agentmods.dev/badge/skills/openhands/extensions/gitlab-issue-to-mr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.05431 |
| Opus 5.5 | $0.00024 | $0.02172 |
| Sonnet 5.5 | $0.00012 | $0.01086 |
| Haiku 4.5 | $0.00006 | $0.00543 |
Grade A, and why
gitlab-issue-to-mr scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
so a connected GitLab server gives the agent typed tools rather than curl. What How it starts
The opening of the file, as written. The whole thing — 450 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitLab Issue to MR Automation
Create a cron automation that watches one or more GitLab projects for issues with a trigger label, starts an OpenHands conversation once per label event with the project's default branch already checked out, and opens a merge request with whatever the agent produced.
The automation script is deterministic: issue discovery, label-event tracking, state persistence, the clone, the branch, the commit, the push, the merge request, the issue comments, and the clone's removal are all handled in Python. The LLM is invoked only to write the code.
The agent is told which issue to implement, not what it says. It fetches the description, the discussion, and whatever they link to itself, so nothing in the prompt goes stale between dispatch and the moment the agent reads it.
That needs read access, so the conversation is handed one secret, GITLAB_TOKEN.
AGENT_SECRET_NAMES stays an allow-list: the rest of the deployment's secret
store is not reachable from a conversation whose instructions came from an issue.
On OpenHands Cloud and Enterprise the conversation runs with the user's own
settings instead: the connected GitLab integration's token, or the tools of the
connected GitLab MCP server.
The deployment's MCP servers are forwarded whole, matching github-pr-reviewer,
so a connected GitLab server gives the agent typed tools rather than curl. What
those servers reach is reachable from an issue-authored prompt, so connect only
servers that may be driven by untrusted text.
The agent also finishes the job: it commits, pushes its branch, and opens the
merge request, so the merge request appears when the agent stops rather than on
the next poll. The script does not trust that it happened - when the conversation
ends it asks GitLab whether the merge request exists, and opens it itself when it
does not. origin still carries no credential, so every GitLab command the agent
runs has to name GITLAB_TOKEN; the SDK only puts a secret in the environment of
a command that mentions it, and masks it in the output.
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +34 lines 6cdfedbe9043
- 13d ago Changed · +7 lines 839fa39a0b8b
- 1mo ago First seen · 409 lines · 59 tokens per session scan A 95b4390e73cc
gitlab-issue-to-mr is a skill published in the GitHub repository OpenHands/extensions (167 stars, last pushed today), licensed MIT. It adds 59 tokens to every session and 5,431 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-15.
Other skills, from other repositories
github-pr-workflow
GitHub PR lifecycle: branch, commit, open, CI, merge.
devops-pipeline
Configure pre-commit hooks and lean GitHub Actions for shift-left quality assurance. Use when adding or auditing CI/CD to maximize local test coverage and minimize CI cost. Skip for Terraform/K8s, deployment pipelines, or non-GitHub CI providers.
dependabot-consolidator
Consolidate a repository's open Dependabot PRs into one tested branch and PR, grouping by ecosystem and risk, verifying with baseline-diff gates, and closing out on operator approval. Use when a repo has multiple open Dependabot PRs to batch, when consolidating dependency bumps into a single reviewable PR, or when…
commit
Delegate a single Conventional Commit.
check-fix
Execute quality gates, fix any issues found, and create a single high-quality Conventional Commit summarizing all changes made.
shared-tooling-git-hooks
Husky v9 setup, lint-staged v16 patterns, commitlint with conventional commits, CI/production handling, monorepo setup, migration from v8.