Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rube-de/cc-skills --skill pr-checkgit clone --depth 1 https://github.com/rube-de/cc-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rube-de/cc-skills/pr-check)<a href="https://agentmods.dev/skills/rube-de/cc-skills/pr-check"><img src="https://agentmods.dev/badge/skills/rube-de/cc-skills/pr-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rube-de/cc-skills/pr-check"><img src="https://agentmods.dev/badge/skills/rube-de/cc-skills/pr-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 181 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 201 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 303 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 332 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Tool Misuse · line 469 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00067 | $0.08347 |
| Opus 5 | $0.00034 | $0.04174 |
| Sonnet 5 | $0.00013 | $0.01669 |
| Haiku 4.5 | $0.00007 | $0.00835 |
Grade A, and why
pr-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 501 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DLC: PR Review Compliance
Fetch PR review comments, implement fixes for unresolved items, and report compliance.
Before running, read ../dlc/references/ISSUE-TEMPLATE.md now for the issue format, and read ../dlc/references/REPORT-FORMAT.md now for the findings data structure.
This skill uses progressive disclosure. The orchestration skeleton (fetch, categorize, reply, coverage-verify, commit) lives in SKILL.md. Conditional branches — fixable implementation, discussion handling, and follow-up issue creation — live in references/ and are read only when their triggering condition fires:
references/fixable-workflow.md— context read, confidence-gated evaluation, implementation guardrails (Step 3)references/discussion-workflow.md— classification, auto-action criteria,AskUserQuestionrouting (Step 3.5)references/followup-and-summary.md— follow-up issue creation, decision-aware replies, PR summary (Step 5)
Do not preload these references — each Step pointer below names its file and its skip condition.
No GitHub mentions in posted text: Any text this skill posts to GitHub — inline replies, review-body replies, issue-comment replies, follow-up issue bodies, and the PR summary — MUST NOT contain an
@-prefixed username or bot name. Write the bare login instead. This applies to bots (copilot,coderabbitai,gemini-code-assist,greptile-apps,qodo-code-review) and humans alike — GitHub turns an@-prefixed username into a live mention notification even for bot accounts, which can trigger unwanted bot actions such as an auto-generated duplicate PR.
- Wrong: attributing a fix to a reviewer with an
@-prefixed name- Right:
Fixed: constrained values to exact literals (copilot)This applies even when quoting a reviewer's own words: when embedding an excerpt of the original comment (e.g. Step 4's
{first 100 chars of original body}), neutralize every@character in the excerpt before writing it — insert a space immediately after it, don't delete it — so a reviewer's own self-mention or tag can't resurrect a live notification when re-posted, while the excerpt still reads recognizably close to the original (an email address or scoped package name the reviewer quoted stays legible instead of turning into different text). Note that not every bot mention goes through GitHub's markdown renderer — some bots (Copilot's coding agent among them) react to a raw substring scan of the comment body, not to rendered links. Neutralizing the@character is the only reliable defense against both; code-fencing or blockquoting an excerpt is not sufficient on its own.This applies just as much to
{reply text}itself — the description the agent composes to explain a fix, dismissal, or answer — not only to the quoted excerpt. A composed reply describing a fix can legitimately contain an@-prefixed technical token (a scoped package bumped as part of the fix, a decorator added, an email in a config example): insert a space after the@there too, the same as in a quoted excerpt. The only case that uses the bare-name form instead of space-insertion is the agent naming a reviewer or bot itself, as in the(copilot)example above.No text that gets posted to GitHub may pass through shell-string interpolation or a heredoc — a heredoc's delimiter only disables expansion inside it, not collision with reviewer-controlled text that happens to match the delimiter itself. See each Step's reply-routing block below for the file-based mechanism (
Writetool +--body-file/-F body=@file) that enforces this.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 501 lines · 67 tokens per session scan A a8fc51b97275
pr-check is a skill published in the GitHub repository rube-de/cc-skills (10 stars, last pushed 3d ago), licensed MIT. It adds 67 tokens to every session and 8,347 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
pr-from-stale-branch-silently-reverts-newer-main-files
Trap: merging a PR whose branch carries an OLD TREE silently DELETES (reverts) files that landed on main after that tree was built — with NO merge conflict to warn you, because a deletion your own commit records is not a conflict. Use when: (1) about to gh pr create or squash-merge from a long-lived / earlier-branched…
parallel-pr-scope-overlap-tiebreaker-delta-check
Before applying a handoff prompt's tiebreaker default ("merge the first-mover", "the clean-against-main one", "the one with reviewer APPROVE") to pick a winner between two parallel PRs that implemented the SAME scope, run gh pr diff on BOTH and audit for substantive deltas. Use when: (1) a session prompt or handoff…
stacked-pr-review-per-base-diff-and-attach
Reviewing a stack of dependent pull requests: diff each one against ITS OWN base rather than against main, and attach the reports to the bottom branch.
subagent-reports-complete-but-pr-unmerged
Catch the systematic gap between sub-agent "completed" status and the actual end state of a PR-merge orchestration task. Use when: (1) you've dispatched multiple parallel sub-agents (general-purpose or specialist) to open + review + merge PRs, (2) the parent receives with status: completed but the sub-agent's last…
working-tree-edits-stranded-on-squash-merge
Diagnose and prevent "I made the fix but it's not on main" cases where the fix was applied in the working tree via Edit / Write but never git added before the squash-merge. Use when: (1) you squash-merged a PR and the user reports the issue is back, (2) git status after the merge shows uncommitted changes for files…
swarm-pi-review
Review a Git working tree or branch with read-only Pi workers. Use standard for bugs, security, regressions, and missing tests; use lean for diff-bound simplification, deletion, reuse, YAGNI, or native replacements. Route one question to ask and broader risk analysis to orchestrate.