Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/vercel/next.js/backport-prnpx skills add vercel/next.js --skill backport-prgit clone --depth 1 https://github.com/vercel/next.jsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vercel/next.js/backport-pr)<a href="https://agentmods.dev/skills/vercel/next.js/backport-pr"><img src="https://agentmods.dev/badge/skills/vercel/next.js/backport-pr.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00097 | $0.00832 |
| Opus 5 | $0.00048 | $0.00416 |
| Sonnet 5 | $0.00019 | $0.00166 |
| Haiku 4.5 | $0.00010 | $0.00083 |
Grade A, and why
backport-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 108 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Backport PR
Use this skill when a user asks to backport a merged Next.js PR to a release branch.
Inputs
- Require a PR number and a target release branch, for example
next-16-2. - If the target branch is not provided and cannot be inferred confidently from the user's request, ask before mutating git state.
- Treat the target branch as variable; do not hard-code
next-16-2except when the user explicitly asks for it.
Workflow
-
Inspect the current worktree before changing branches:
git status --short git branch --show-currentPreserve unrelated user changes. Do not overwrite, reset, or stash them without the user's consent.
-
Sync the source and target branches:
git fetch origin canary:refs/remotes/origin/canary <target-branch>:refs/remotes/origin/<target-branch> -
Identify the commit that landed the PR on
canary:gh pr view <pr-number> --repo vercel/next.js --json number,title,state,url,mergeCommit,baseRefName,headRefName git log origin/canary --oneline --fixed-strings --grep="(#<pr-number>)"Prefer
mergeCommit.oidwhen the PR isMERGEDand the commit is contained inorigin/canary. If GitHub does not return a usable merge commit, use thegit log --grepresult and verify the commit subject references the PR number. -
Create the backport branch from the release branch:
git switch -c backport-<pr-number>-to-<target-branch> origin/<target-branch>After switching branches in this repo, run
pnpm build-allbefore Next.js integration tests unless the user explicitly limits the task to preparing the cherry-pick or PR. -
Cherry-pick the landed commit with provenance:
git cherry-pick -x <merged-commit-sha>Resolve conflicts in favor of preserving the release branch's compatibility constraints. If the cherry-pick is empty, verify whether the change is already present on the release branch and report that instead of opening a duplicate PR.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 108 lines · 97 tokens per session scan A a8e3e5143fa2
backport-pr is a skill published in the GitHub repository vercel/next.js (142,020 stars, last pushed 3d ago), licensed MIT. It adds 97 tokens to every session and 832 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
changeset-pr
Create or update a .changeset/.md file for the current branch or PR in this repository, choose the correct package scope and release type, and verify the result against repo-specific Changesets config. Use when a publishable package changed, when a PR is missing a changeset, when an existing changeset needs…
release
Bump version, generate an AI-written changelog, and publish a GitHub release. Use when the user says "release", "publish", or "bump version".
release-workflow
Release/publish the spikard Rust core crate and CLI end-to-end. Load when releasing or publishing spikard — cutting a new version, tagging, running gh release create, and installing the released build locally. Covers version set via Taskfile, CHANGELOG roll, the clean-tree precondition, GitHub release, local install…
npm-publish
Use when publishing Node/npm packages from a repository or monorepo, especially scoped public packages, beta/latest dist-tags, workspace publishing, npm 2FA, publish verification, local tarball smoke tests, and debugging npm publish/install errors such as E403, E404, ENOVERSIONS, ELOOP, or pack destination failures.
release
Release remotion-bits to GitHub, Cloudflare, and npm. Use when bumping the package version, updating CHANGELOG.md, building the registry, creating the release commit, pushing master, opening a prefilled GitHub release form, deploying docs, and publishing to npm.
release-announcement
Write a release announcement — changelog, blog post, in-app note, or social post — that leads with user impact, names the audience, and includes upgrade/migration steps without filler.