Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ReflexioAI/claude-smart --skill create-prgit clone --depth 1 https://github.com/ReflexioAI/claude-smartWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/reflexioai/claude-smart/create-pr)<a href="https://agentmods.dev/skills/reflexioai/claude-smart/create-pr"><img src="https://agentmods.dev/badge/skills/reflexioai/claude-smart/create-pr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/reflexioai/claude-smart/create-pr"><img src="https://agentmods.dev/badge/skills/reflexioai/claude-smart/create-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 63 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Excessive Agency · line 10 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.01341 |
| Opus 5.5 | $0.00030 | $0.00536 |
| Sonnet 5.5 | $0.00015 | $0.00268 |
| Haiku 4.5 | $0.00007 | $0.00134 |
Grade A, and why
create-pr scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
<How the changes were verified — manual testing steps, automated tests run, curl commands, etc.> Copies of this mod
1 near-identical copy found in the catalogue:
- create-pr — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 140 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PR Creator
Create well-structured, reviewer-friendly pull requests following best practices.
CRITICAL: This skill MUST always result in a PR being created. Do NOT stop early, do NOT ask the user to run another command first. Handle all prerequisites (committing, branching, pushing) inline and proceed to gh pr create.
Workflow
Step 1: Pre-flight Checks
Run these checks before anything else:
- Verify GitHub CLI authentication — run
gh api user --jq '.login'to confirm the CLI is authenticated. If this fails, tell the user to rungh auth loginfirst and stop. - Determine the base branch — default to
main. If the user specifies a different base, use that. Capture as$BASE_BRANCH.
Step 2: Commit Uncommitted Changes
Run git status to check for uncommitted changes. If there are uncommitted changes, commit them directly — do NOT delegate to another skill or tell the user to commit first.
- Stage changes — run
git add <files>for relevant modified/untracked files. Do not stage.envor gitignored files. - Lint and format — if Python files are staged, run:
Re-stage any modified files.ruff check --fix <files> && ruff format <files> - Commit — write a conventional commit message based on the staged diff:
If precommit hooks modify files, re-stage withgit commit -m "<type>: <description>"git add -uand retry (up to 3 times).
Step 3: Ensure Feature Branch
- Check current branch — run
git branch --show-current. - If on
$BASE_BRANCH, create a feature branch:- Analyze the commits/changes to pick a descriptive name (e.g.,
feat/add-auth,fix/login-bug) - Run
git checkout -b <branch-name>
- Analyze the commits/changes to pick a descriptive name (e.g.,
- If on a different branch, check whether the branch has PR-worthy commits vs
$BASE_BRANCH:- Run
git log $BASE_BRANCH..HEAD --oneline - If there are commits, use the current branch as-is
- If there are NO commits (branch is at same point as base), this means something went wrong — investigate and fix
- Run
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 140 lines · 74 tokens per session scan A afdd81ca687c
create-pr is a skill published in the GitHub repository ReflexioAI/claude-smart (789 stars, last pushed today), licensed Apache-2.0. It adds 74 tokens to every session and 1,341 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
connect-data-source
Connect Braintrust, Langfuse, LangSmith, Phoenix Cloud, or OpenTelemetry traces to Reflexio through its setup APIs. Guide the agent developer through traffic selection and field mapping, save and validate a draft, and return the Reflexio review link for frontend activation. Do not add an interaction-publish flow.
smart-rebase
Smart partial rebase for squash-merge repositories. Auto-detect which commits to keep/drop when base branch was squash-merged into target. Use when: user says 'rebase', 'partial rebase', 'base already merged', 'smart rebase', or /smart-rebase. Not for: simple git rebase (the developer runs it — no skill executes…
resolving-merge-conflicts
Use when a git merge or rebase reports conflicts and the operation is in progress.
deploy-landed
A deployment verification procedure that checks whether the intended code revision is actually running, its environment settings are present, and the product works. A deployment is the process of putting new software on a server or hosting platform.
check-pr
Read-only inspection of a single GitHub PR lifecycle — checks CI, review feedback (threads, review bodies, top-level comments), description sync, and mergeability, and returns PASS or FAIL with per-gate findings. Never invokes the merge button. Use when verifying a PR is ready to merge, polling lifecycle progress…
merge-prep
Pre-merge analysis and preparation. Analyzes source branch vs target branch: commit stats, conflict detection, file impact. Analysis-only v1 — outputs report + suggested commands, does not auto-merge. Use when: user says 'merge prep', 'pre-merge', 'merge analysis', or /merge-prep.