Borrowing it
Nothing to install: this file belongs to PostHog/posthog-foss. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/PostHog/posthog-foss/master/.agents/skills/triaging-merge-queue-failures/SKILL.mdgit clone --depth 1 https://github.com/PostHog/posthog-fossWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/posthog/posthog-foss/triaging-merge-queue-failures)<a href="https://agentmods.dev/skills/posthog/posthog-foss/triaging-merge-queue-failures"><img src="https://agentmods.dev/badge/skills/posthog/posthog-foss/triaging-merge-queue-failures.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 89 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Data Exfiltration · line 97 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00180 | $0.06617 |
| Opus 5 | $0.00090 | $0.03308 |
| Sonnet 5 | $0.00036 | $0.01323 |
| Haiku 4.5 | $0.00018 | $0.00662 |
Grade A, and why
triaging-merge-queue-failures scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **`gh` is not installed.** Both helpers fall back to `curl` with `$GITHUB_TOKEN` and page by hand, so prefer them for everything they cover — reads, and the verdict comment. For anything else, either use `curl` against How it starts
The opening of the file, as written. The whole thing — 265 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Triaging merge queue failures
One triage is one PR plus its latest Trunk queue attempt: establish the facts, walk the decision chart below, and end with a verdict and its action. Runs are either interactive (a developer asked about a kicked PR) or unattended (a scheduled sweep over recent kicks); the chart is identical, only the actions you may take yourself differ.
/merging-prs covers enqueueing and babysitting; this skill starts where it hands off, at a failed or removed queue entry.
How Trunk reports queue state here
Read this before writing any command. It is the part that goes stale.
Trunk publishes no check run in this repository. The trunk-io app posts zero check runs — not on the PR head, not on the queue branch. A predicate like select(.name | startswith("Trunk Merge Queue")) matches nothing, and a sweep built on it reports zero verdicts forever while the queue runs normally. /merging-prs, /debugging-ci-failures and AGENTS.md used to assert that check run exists; all three now point at trunk merge status instead.
Trunk exposes queue state three ways. Only the first carries Trunk's own reasons; the other two are what the GitHub API can see, and they are what this skill's helpers read:
trunk merge status <n>(the CLI) — the full state machine with a reason per transition, in Trunk's words. This is the primary source for why, and the only one that surfaces conflicts, line-skips and cancellations at all. Human text only, no--json. The same timeline is exportable as JSON from the Trunk dashboard.- One sticky comment per PR, authored by
trunk-io[bot], rewritten in place as state changes. It carries the current state, the failing check's name, and a link to the failing job. Rewritten means no history: earlier reasons are gone. It can also carry aFailed Test | Failure Summary | Logstable naming the failing test outright — check it before reading any log, and note it is empty for suites that do not upload results to Trunk. - One draft shadow PR per queue attempt, authored by
trunk-io[bot], with head reftrunk-merge/pr-<n>/<uuid>. Its head SHA carries the attempt's real CI as ordinarygithub-actionscheck runs, with job links. A-bisectionsuffix means Trunk is bisecting a failed batch to find the culprit.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +60 lines · +9 tokens per session 37de165a81a8
- 4d ago First seen · 205 lines · 171 tokens per session scan A 5a1cf0219b20
triaging-merge-queue-failures is a skill published in the GitHub repository PostHog/posthog-foss (714 stars, last pushed today), licensed MIT. It adds 180 tokens to every session and 6,617 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
agent-merge-conflict-arbiter
Neutral arbiter for merge conflicts between two agents.
git-advanced-workflows
Master advanced Git workflows including rebasing, cherry-picking, bisect, worktrees, and reflog to maintain clean history and recover from any situation. Use when managing complex Git histories, collaborating on feature branches, or troubleshooting repository issues.
bisect
Bisect regressions or broken builds in the Chromium repository using deterministic binary search, checking out midpoint commits, syncing dependencies with gclient sync, compiling the target with autoninja, and querying the user for test results until the culprit commit is isolated.
mantis-critic
Assesses the production viability of findings, filtering out debug-only features and assertion traps. Use when findings have been validated and you need to confirm they are triggerable in production release builds (with assertions disabled). Don't use for writing reproduction scripts or patches.
hotpath_bump
Bump the hotpath version number across the workspace and related files. Updates crate versions in Cargo.toml files (exact patch version) and version references in the backend middleware, hotpathinit skill, and README (major.minor only). Use when the user wants to bump, bump the version, or release a new hotpath…
comet-github-issue-fix
A workflow for fixing a confirmed Comet-related GitHub issue or review blocker within an isolated scope. It covers matching the work to the relevant workflow, testing the change, checking runtime results, and preparing a careful handoff.