pr-contribution-handler

A workflow for taking external contributor pull requests from review through completion. It checks the proposed code, handles review comments, updates the branch, and evaluates whether changes are ready to merge.

In plain words
What is it for?
Use it when shepherding one or more contributor pull requests, improving their implementation, resolving review feedback, and deciding whether to merge or request more work.
Why use it?
It helps ensure a contribution is maintainable and follows project rules, rather than checking only whether automated tests pass.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/phase-rs/phase/pr-contribution-handler
Any agent
npx skills add phase-rs/phase --skill pr-contribution-handler
Clone the repo
git clone --depth 1 https://github.com/phase-rs/phase

Made for: Claude Code, Codex.

Per session 80 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 15,580 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00080 $0.15580
Opus 5 $0.00040 $0.07790
Sonnet 5 $0.00016 $0.03116
Haiku 4.5 $0.00008 $0.01558

Measured 2d ago against content hash 52777a536605, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

pr-contribution-handler scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

- [ ] **No workflow or instruction edits in the final diff.** Re-grep the post-fix diff for any path under `.github/workflows/`, `.github/actions/`, `.claude/`, `CLAUDE.md`, `AGENTS.md`, `docs/AI-CONTRIBUTOR.md`, or this

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

Do not approve, enqueue, or leave auto-merge enabled for a PR with a proof gap. Request concrete proof first: template-complete verification, discriminating runtime tests or equivalent boundary tests, exact commands/chec
.claude/skills/pr-contribution-handler/SKILL.md · 591 lines

How it starts

The opening of the file, as written. The whole thing — 591 lines — stays where its author put it; the contents beside it link to each section on GitHub.

PR Contribution Handler

Use this skill when the user provides a GitHub PR number, URL, branch, or list of PRs and asks to handle contributor work end-to-end.

The goal is not just "make CI green." The goal is to leave the PR in the most idiomatic, maintainable, rules-correct shape reasonable for its scope.

Maintainer Quality Bar — READ FIRST (non-negotiable, overrides "just merge it")

This skill lands contributor work, but only after it meets the maintainer's bar — and the bar is "is this PR the best it can be, behaviorally AND architecturally?" not "does CI pass?" The maintainer must be able to be confident in the review itself before anything merges. Apply every rule below to every PR.

  1. You may — and should — improve the author's PR. "We can make changes to the author PR; we just need to ensure it's the best it can be." When a PR is correct but not idiomatic/clean/complete, fix it on the contributor's branch (push when maintainerCanModify=true; verify the fork remote points at the right contributor before pushing) rather than merging as-is or leaving a nit. Bring it to the shape a principal engineer would merge. If review finds only a couple small, local, low-risk changes between the PR and mergeability, do those fixups yourself instead of making the contributor chase another review round.

  2. CI/Tilt green is necessary, NOT sufficient. Green CI proves it compiles and existing tests pass. It does not prove correctness, no-regression, or performance. Never present "CI green" as evidence a PR is ready. For every PR you must additionally:

    • Trace the changed logic by hand, end to end, for the target case AND 2–3 sibling cases in the class AND the obvious edge cases (multiplayer, zero/empty, interaction with existing effects). Confirm it actually produces the rules-correct result — not merely that it "conforms to CLAUDE.md."
    • Verify the tests DISCRIMINATE. For every assertion, ask: would this fail if the fix were reverted? An assertion that passes both before and after the fix is coverage theater. A bug-fix PR must have at least one runtime test that drives the engine through the real pipeline (apply() / scenario runner) and would fail without the change. Name any behavior with no discriminating test as a gap, and add the missing test before enqueue.
    • Read the parse-diff sticky comment (engine/parser-surface PRs). CI posts a sticky comment (marker <!-- coverage-parse-diff -->) with the card-level parse changes this PR introduces — it exists for the reviewing LLM and is required evidence, not optional context. Fetch its full body and confront the card diff against the PR's claimed scope: unexplained gained/lost/changed cards are findings (scope contamination or unintended parser blast radius). The pr_review.py packet's parse_diff field carries presence/state/updated_at; compare updated_at against the head's push time to confirm the diff reflects the current head. If the comment is absent but engine source changed, treat it as missing evidence and check whether CI ran for the current head before reviewing.

Read the full file on GitHub · 591 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 591 lines · 80 tokens per session scan B 52777a536605

Subscribe to this mod's changes

pr-contribution-handler is a skill published in the GitHub repository phase-rs/phase (259 stars, last pushed 2d ago), licensed Apache-2.0. It adds 80 tokens to every session and 15,580 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

qa-cli-mcp-api

Select and run explicitly requested, risk-based QA for Anarlog's CLI, webhooks, stdio MCP, hosted Cloud API, and remote MCP. Test only affected lanes unless comprehensive coverage is requested.

fastrepl/anarlog · 47 tokens

product-update-newsletter

Draft, update, or audit a crisp, changelog-grounded Anarlog product-update newsletter in Loops (app.loops.so) for a desktop release. Use after the changelog is merged, when asked to draft, revise, or pre-send check the release announcement email.

fastrepl/anarlog · 62 tokens

sqlite-schema-design

Design or review schemas for crates/cloudsync using SQLite Sync constraints, not generic SQLite advice. Use when adding synced tables, changing synced columns, or planning CloudSync-safe migrations.

fastrepl/anarlog · 42 tokens

release-new-version

Release a new desktop stable version for Anarlog. Use when asked to cut, publish, or prepare a new stable desktop release after checking and merging the changelog.

fastrepl/anarlog · 38 tokens

fix-ready-prs

Inspect every open non-draft PR for CI failures and unresolved Cursor Bugbot findings, then fix them on the existing PR branches. Use when asked to check active PRs, triage ready PRs, fix CI, or address Bugbot comments.

fastrepl/anarlog · 55 tokens

reactive-sqlite-ui

Build SQLite-backed reactive UI in apps/desktop using stable patterns for reads, selection, forms, writes, and loading states. Use when implementing or reviewing screens built on useDrizzleLiveQuery and SQLite mutations.

fastrepl/anarlog · 53 tokens