Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pekral/cursor-rules --skill pr-staged-merge-plangit clone --depth 1 https://github.com/pekral/cursor-rulesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pekral/cursor-rules/pr-staged-merge-plan)<a href="https://agentmods.dev/skills/pekral/cursor-rules/pr-staged-merge-plan"><img src="https://agentmods.dev/badge/skills/pekral/cursor-rules/pr-staged-merge-plan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pekral/cursor-rules/pr-staged-merge-plan"><img src="https://agentmods.dev/badge/skills/pekral/cursor-rules/pr-staged-merge-plan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00097 | $0.03059 |
| Opus 5.5 | $0.00039 | $0.01224 |
| Sonnet 5.5 | $0.00019 | $0.00612 |
| Haiku 4.5 | $0.00010 | $0.00306 |
Grade A, and why
pr-staged-merge-plan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Constraints
- Apply
@rules/git/general.mdc— every proposed commit subject follows Commit Messages (English,type(scope): short description, lowercase, allowed types only, no trailing period) and every proposed unit follows One phase = one commit. - Read-only. Never run
git rebase,git commit --amend,git cherry-pick,git reset,git push,gh pr merge, orgh pr edit. This skill produces a plan; a human or a follow-up skill executes it. - Load PR context only through
skills/code-review-github/scripts/load-issue.sh <NUMBER|URL>. Never callgh pr view/gh api /repos/.../pulls/...directly; fall back to the GitHub MCP server only when the loader is unavailable (exit code 2/3). Localgit log/git diffreads against the loaded base and head refs are expected and allowed. - Merging a unit is owned by
@skills/merge-github-pr/SKILL.md; interactive-rebase, conflict, and force-with-lease mechanics are owned by@skills/git-workflow/SKILL.md. Reference them — do not restate them. - Commit-level reshaping inside one PR is owned by
@rules/git/general.mdcGit Rules, not by this skill. This skill is the on-demand deeper plan: it splits the work into several pull requests, each with its own review-and-merge gate — the answer for units that cannot ship inside one PR (destructive migration, consumer-contract change needing expand → migrate → contract across deploys). - Every unit is its own pull request and carries its own hard code-review gate (
@rules/git/general.mdcMerging): the plan never proposes merging a unit whose own diff has not been reviewed to 0 Critical + 0 Moderate. - No work may be dropped or re-scoped. The union of the proposed units must equal the current PR's diff exactly — same files, same net content. State this reconciliation explicitly in the output.
- Do not publish the plan anywhere unless the user asks for it. When asked, apply
@rules/reports/general.mdc(assignment language) and post it viaskills/code-review-github/scripts/upsert-comment.sh <NUMBER|URL> -— never a rawgh pr comment.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 113 lines · 97 tokens per session scan A 07035ac78bbf
pr-staged-merge-plan is a skill published in the GitHub repository pekral/cursor-rules (11 stars, last pushed 26d ago), licensed MIT. It adds 97 tokens to every session and 3,059 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
publish-package
Package registry publishing for npm, crates.io, PyPI, and Homebrew. Verifies prerequisites, runs the publish command, confirms success, and surfaces actionable error hints on failure.
release-branch
Make the merge/PR/keep/discard decision for a feature branch, verify coverage gates, create the PR with gh, and clean up the worktree. Use when a feature is done and ready to ship, or when user says "release", "merge", or "open a PR".
release-notes
Summarize a logical grouping of git commits into plain-language release notes for non-technical readers. Use when the user asks for release notes, what changed, a summary of commits, a plain-English changelog, or an easy-to-read bullet list of work at a specific reading level (default 8th grade). Ask which boundary to…
larapilot-release
Manages the versions of the product: semver releases, which story targets which version, progress and forecast per version, release notes, and Gitflow release branches. Requires releasemode=YES. Italian: release, versione, versioni, semver, note di rilascio.
fable-release
Audit and certify repository merge and release readiness against required quality gates, clean git working trees, and verified distribution artifacts. Use when preparing a release tag, validating release checklist criteria, publishing npm/PyPI packages, or certifying a branch for merge — even if the user does not…
cognitive-version-snapshot
A controlled process for saving a major new version of a system document as a dated snapshot.