Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wan-huiyan/agent-traffic-control --skill gh-pr-merge-squash-stdout-shows-sibling-files-as-createdgit clone --depth 1 https://github.com/wan-huiyan/agent-traffic-controlWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wan-huiyan/agent-traffic-control/gh-pr-merge-squash-stdout-shows-sibling-files-as-created)<a href="https://agentmods.dev/skills/wan-huiyan/agent-traffic-control/gh-pr-merge-squash-stdout-shows-sibling-files-as-created"><img src="https://agentmods.dev/badge/skills/wan-huiyan/agent-traffic-control/gh-pr-merge-squash-stdout-shows-sibling-files-as-created/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wan-huiyan/agent-traffic-control/gh-pr-merge-squash-stdout-shows-sibling-files-as-created"><img src="https://agentmods.dev/badge/skills/wan-huiyan/agent-traffic-control/gh-pr-merge-squash-stdout-shows-sibling-files-as-created.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00243 | $0.01252 |
| Opus 5 | $0.00121 | $0.00626 |
| Sonnet 5 | $0.00049 | $0.00250 |
| Haiku 4.5 | $0.00024 | $0.00125 |
Grade A, and why
gh-pr-merge-squash-stdout-shows-sibling-files-as-created scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.
gh pr merge --squash stdout shows sibling-PR files as "created" — don't panic, check the commit
Problem
You squash-merge a clean, well-scoped PR and gh pr merge --squash echoes a
diffstat that's far bigger than your change, including create mode lines for
files you never touched:
19 files changed, 744 insertions(+), 7 deletions(-)
create mode 100644 docs/handoffs/session_24_handoff.md
create mode 100644 docs/handoffs/session_25_prompt.md
...
This reads exactly like the git-add-all-sweeps-untracked-artifacts-into-commit
trap — as if your feature PR smuggled unrelated docs onto main. It is alarming
mid-deploy. But the files shown as "created" were already on main (added by
sibling PRs merged after your branch's start point), and your actual squash
commit does not contain them.
Context / Trigger Conditions
gh pr merge --squash(or--squash --delete-branch) prints a diffstat with more files / higher insertions than your PR's real diff.create mode 100644 <file>appears for files added by other PRs merged since you branched (common when each session branches offmainand several sibling PRs have merged in between).- You're about to revert / force-push / re-open in response to the scary echo.
Solution
Do not trust the merge command's stdout as the record of what landed. The
echoed diffstat can be computed against an older ancestor than the current
main tip, so files already present on main appear as new. Verify the actual
squash commit:
git fetch origin --quiet
git show --stat origin/main | head -40 # the real squash commit + its file list
If the squash commit lists only your PR's files (and the insertion count matches), the merge is clean — the stdout was just a misleading view. Optionally confirm a specific file you feared was smuggled is NOT in the commit:
git show --stat origin/main | grep -c "session_2" # 0 = not in the commit ✓
Only react (revert) if git show --stat origin/main itself shows the foreign
files — that's the authoritative source, not the merge echo.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 104 lines · 243 tokens per session scan A 5c6c92b39c34
gh-pr-merge-squash-stdout-shows-sibling-files-as-created is a skill published in the GitHub repository wan-huiyan/agent-traffic-control (3 stars, last pushed yesterday), licensed MIT. It adds 243 tokens to every session and 1,252 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ql-housekeep
Detect repo-hygiene issues that accumulate during long-running autonomous development (merge-conflict markers, orphan worktrees, CPC-variant duplicates, stale branches, version-manifest drift). Detection-only by default — reports findings, never deletes or modifies without explicit user confirmation.
nazgul:doctor
Run the Nazgul read-only preflight diagnostic — checks jq/gh presence and auth, git-hooks drift, cache-vs-repo plugin version, the bash-vs-zsh hazard, the NAZGULDIR footgun, config-schema staleness, either install mode's .gitignore Nazgul-block drift (stamp and flush-left region), cross-session messaging and Remote…
hotfix
Emergency fix workflow that bypasses normal sprint processes with a full audit trail. Creates hotfix branch, tracks approvals, and ensures the fix is backported correctly.
cloudflare-workers-ci-cd
Complete CI/CD guide for Cloudflare Workers using GitHub Actions and GitLab CI. Use for automated testing, deployment pipelines, preview environments, secrets management, or encountering deployment failures, workflow errors, environment configuration issues.
cloudflare-workers-observability
Cloudflare Workers observability with logging, Analytics Engine, Tail Workers, metrics, and alerting. Use for monitoring, debugging, tracing, or encountering log parsing, metric aggregation, alert configuration errors.
cloudflare-workers-dev-experience
Cloudflare Workers local development with Wrangler, Miniflare, hot reload, debugging. Use for project setup, wrangler.jsonc configuration, or encountering local dev, HMR, binding simulation errors.