Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add shabaraba/vibing.nvim --skill stacked-pr-mergegit clone --depth 1 https://github.com/shabaraba/vibing.nvimWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shabaraba/vibing.nvim/stacked-pr-merge)<a href="https://agentmods.dev/skills/shabaraba/vibing.nvim/stacked-pr-merge"><img src="https://agentmods.dev/badge/skills/shabaraba/vibing.nvim/stacked-pr-merge/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/shabaraba/vibing.nvim/stacked-pr-merge"><img src="https://agentmods.dev/badge/skills/shabaraba/vibing.nvim/stacked-pr-merge.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00112 | $0.01189 |
| Opus 5.5 | $0.00045 | $0.00476 |
| Sonnet 5.5 | $0.00022 | $0.00238 |
| Haiku 4.5 | $0.00011 | $0.00119 |
Grade A, and why
stacked-pr-merge scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Merging a Stack of PRs
A stack is a branch cut from another PR's branch instead of from main. Everything below was
measured on shabaraba/vibing.nvim; each item is something that failed first.
gh pr view / gh issue view have been observed exiting 0 with no output on this machine. Read
PR state with gh api throughout, not with the porcelain commands.
The merge call
gh pr merge and PUT /repos/{owner}/{repo}/pulls/{n}/merge both come back 403 here. The one
that works is the async endpoint:
OWNER=shabaraba REPO=vibing.nvim N=<pr number>
SHA="$(gh api "repos/$OWNER/$REPO/pulls/$N" --jq '.head.sha')"
gh api --method PUT "repos/$OWNER/$REPO/pulls/$N/merge-async" \
-f "sha=$SHA" -f 'merge_method=merge'
merge_method=merge, notsquash. A stack depends on its lower PR's commits existing as themselves; squashing the bottom one rewrites the history every branch above it was cut from.- Take
shafrom the API. Expanding a short SHA by hand fails withPull request head branch was modified— the value has to be the full head SHA the API is reporting right now, not one you copied from a log. - It is async. The response is not the outcome. Confirm with
gh api "repos/$OWNER/$REPO/pulls/$N" --jq '.merged, .merge_commit_sha'before touching the next PR in the stack.
Merge bottom-up, one at a time
Merge the lowest PR, wait for it to land, confirm CI is green on the next one, then merge that. Do not queue several merges; each merge is what rewrites the branches above it.
GitHub rebases the stack at merge time, not at force-push time. So:
- Pushing additional commits to a lower PR (a fast-forward) leaves the branches above it alone — no upstream rebase needed.
- Rebasing a lower PR, or merging it, does rewrite what the branches above were cut from, and they need the treatment in the next section.
The stale-lineage trap
A branch cut from a lower PR's pre-merge tip is not repaired by git rebase origin/main. That
command replays every commit since the merge base — which includes the lower PR's old,
pre-rebase commits, now superseded on main — and the result is a pile of conflicts in files
you never touched. It is not a real conflict; it is the same change arriving twice.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 27d ago First seen · 101 lines · 112 tokens per session scan A 08c009f3b900
stacked-pr-merge is a skill published in the GitHub repository shabaraba/vibing.nvim (13 stars, last pushed yesterday), licensed MIT. It adds 112 tokens to every session and 1,189 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-20.
Other skills, from other repositories
nav-pilot
Dispatch a Navigator task doc to Pilot as a labeled GitHub issue. Use when user says "dispatch TASK-XX to Pilot", "hand off to Pilot", "send to Pilot", or "queue for Pilot". One-way handoff (Navigator authors the spec, Pilot executes autonomously).
security-pipeline
Use when security verification is needed - pre-commit security checks, vulnerability scanning, STRIDE threat analysis. Integrates with /handoff-verify --security and /commit-push-pr. CWE Top 25 based.
dex-rollback
Rewind one receipt-backed Dex adoption through the frozen lifecycle service. Use when the user says 'undo the update', 'go back', 'that broke something after updating'. Not for applying an update; use dex-update.
pr-triage
4-phase PR backlog management with audit, deep code review, validated comments, and optional worktree setup. Use when triaging pull requests, catching up on pending code reviews, or managing a backlog of open PRs. Args: 'all' to review all, PR numbers to focus (e.g. '42 57'), 'en'/'fr' for language, no arg = audit…
land-and-deploy
Merge PR, wait for CI, verify deploy, run canary. The complete landing pipeline.
git-ai-archaeology
Analyze AI config evolution in a git repo. Use when mapping AI adoption history, finding when configs were first introduced, charting commit velocity by month, or identifying maturity phases in a project's AI tooling.