Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sageox/ox --skill ox-cli-pr-headergit clone --depth 1 https://github.com/sageox/oxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sageox/ox/ox-cli-pr-header)<a href="https://agentmods.dev/skills/sageox/ox/ox-cli-pr-header"><img src="https://agentmods.dev/badge/skills/sageox/ox/ox-cli-pr-header/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sageox/ox/ox-cli-pr-header"><img src="https://agentmods.dev/badge/skills/sageox/ox/ox-cli-pr-header.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00138 | $0.00530 |
| Opus 5.5 | $0.00055 | $0.00212 |
| Sonnet 5.5 | $0.00028 | $0.00106 |
| Haiku 4.5 | $0.00014 | $0.00053 |
Grade A, and why
ox-cli-pr-header scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Run the command and follow the guidance field it returns. This skill is a
thin relay: the behavioral rules ship in ox pr header --json, so every AI
coworker gets them from the live binary — not just the ones that install skills.
ox pr header --json
Add what the PR credits (the current session is auto-linked):
--plan pln_…— a plan you saved this session. Repeatable.--discussion cnv_…— a recorded discussion the PR came directly out of. Rare, and never auto-discovered: only you can judge direct relevance. Ids come fromox conversation list.--session <url|ses_id>— adds or overrides sessions.--allow-unconfirmed— accept links that may not resolve yet.
Then write the body via a file, never a heredoc — a heredoc mangles the markup:
ox pr header > body.md
printf '\n' >> body.md
cat description.md >> body.md # your written summary
# ...keep the SageOx-Session: trailer as the last line...
gh pr create --body-file body.md
When nothing is emitted
The header renders only when it can link at least one artifact a reviewer can
open. With no session, plan, or discussion, ox pr header prints nothing on
stdout and says why on stderr — a team name alone is not a credit. That is the
correct outcome, not an error: paste nothing and move on.
It also no-ops when pr_visuals.header is off (a team or user opt-out). Don't
force a header in that case.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -32 lines · -4 tokens per session 1d9b73386372
- 1mo ago First seen · 81 lines · 142 tokens per session scan A 2a57f4496d1b
ox-cli-pr-header is a skill published in the GitHub repository sageox/ox (66 stars, last pushed today), licensed MIT. It adds 138 tokens to every session and 530 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-08.
Other skills, from other repositories
intuitive-squash
Safely rewrite noisy local history into reviewable commits, with aggressive or moderate plan choices, when the user explicitly asks to squash.
chinese-commit-conventions
A Chinese-language convention for writing Git commit messages, based on Conventional Commits, a standard format that tools can use to classify changes and build changelogs.
dev-updates
Detect and summarize uncommitted git changes grouped by feature area, then generate a structured commit message. Use when the user says "what's the update?", "what changed?", "summarize my changes", "what have I done?", or "what did I update?".
setup-pre-commit
Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing.
commit-staged
This skill should be used when user asks to "commit these changes", "write commit message", "stage and commit", "create a commit", "commit staged files", or explicitly invokes "commit-staged".
paseo-alignfirst-workspace
Register or archive an AlignFirst workspace or an existing worktree as a Paseo workspace. Read it before creating or removing any workspace or worktree when the session runs inside Paseo.