Borrowing it
Nothing to install: this file belongs to xsovad06/sova. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/xsovad06/sova/main/.agents/skills/sova-integrate-pr/SKILL.mdgit clone --depth 1 https://github.com/xsovad06/sovaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xsovad06/sova/sova-integrate-pr)<a href="https://agentmods.dev/skills/xsovad06/sova/sova-integrate-pr"><img src="https://agentmods.dev/badge/skills/xsovad06/sova/sova-integrate-pr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xsovad06/sova/sova-integrate-pr"><img src="https://agentmods.dev/badge/skills/xsovad06/sova/sova-integrate-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.13783 |
| Opus 5.5 | $0.00014 | $0.05513 |
| Sonnet 5.5 | $0.00007 | $0.02757 |
| Haiku 4.5 | $0.00004 | $0.01378 |
Grade D, and why
sova-integrate-pr scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 14d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
PUSHED=$(cat "$PRIMARY_ROOT/.claude/agent-control/integrate-pushed" 2>/dev/null || echo 0) Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$TRIAL" "$GUARD"; git update-ref -d "$TRIAL_REF" 2>/dev/null; git worktree prune' EXIT How it starts
The opening of the file, as written. The whole thing — 797 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Integrate PR
Merge a PR that is already ready, then clean up. Verifies mergeability, checks the replayed commits for silent reverts, merges, audits what actually landed, cleans up branches/worktrees/stashes, closes the linked issue, and runs post-merge cleanup. Replaces the need to run the sova-after-merge skill separately. Works for both manual invocation and autonomous agent use.
This command does not push by default. A push creates a new head SHA and spends a full CI cycle, which on a ready PR is pure waste and delays the merge by the length of the suite. The PR is expected to arrive here mergeable, with review learnings and documentation already folded in by the sova-address-pr skill. Two things justify a push, both meaning another PR merged into the base branch since this one was last pushed: a real conflict (mergeable: CONFLICTING), or, under this repository's strict status-check policy, the branch simply being behind (mergeStateStatus: BEHIND) even with no conflicting lines. Phase 2 resolves either case and is explicit about the cost.
PR: the arguments provided when this skill is invoked
Instructions
Shell blocks. Every fenced block below runs as its own shell invocation: no variable survives from one block to the next, so each block assigns every variable it reads. <PR_NUMBER>, <BASE_BRANCH>, <HEAD_BRANCH> and <ISSUE_NUMBER> are filled in from the Phase 1 metadata.
Primary checkout. State shared between phases lives in the PRIMARY checkout's .claude/agent-control/. The Update subroutine may cd into a per-issue worktree, and .claude/agent-control/ is not mirrored into worktrees, so a bare relative path would read and write a different file depending on where each phase runs. Every block that needs it opens with these two lines (the first is git rev-parse --git-common-dir; the case maps a linked worktree to its primary checkout), never assuming the current directory is it:
COMMON_DIR=$(git rev-parse --git-common-dir 2>/dev/null)
case "$COMMON_DIR" in /*) PRIMARY_ROOT="${COMMON_DIR%/.git}" ;; *) PRIMARY_ROOT="$(git rev-parse --show-toplevel)" ;; esac
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 14d ago Changed · +44 lines 5db58b2d8c01
- 16d ago Changed · +178 lines · +7 tokens per session scan B → D adde795b7d06
- 22d ago First seen · 575 lines · 29 tokens per session scan B 0a2bae5bf65f
sova-integrate-pr is a skill published in the GitHub repository xsovad06/sova (2 stars, last pushed today), licensed Apache-2.0. It adds 36 tokens to every session and 13,783 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it D with 2 findings (reads agent configuration directories, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-08.
Other skills, from other repositories
github
Skill "github" from Hmbown/Codewhale, covering github, when to use, setup, workflow and non-goals.
steward
Drive an mxcli pull request Claude opened to green and merge it. Covers when to open it, the local gate to pass before every push (make ci-local), which CI failure is a known runner flake, how to resolve the conflicts this repo keeps hitting, how to read the AI PR Review comment, and the merge-on-green default. Read…
git-iris
Use this skill when generating commit messages, pull request descriptions, release notes, changelogs, or code reviews in a repository where git-iris is available. Activates on requests like "commit this", "write a commit message", "draft a PR", "generate release notes", "write a changelog", or "review my changes" when…
shipping-and-launch
Prepares production launches. Use when preparing to deploy to production, or when asking what needs to be in place before shipping. Use when you need a pre-launch checklist, when setting up monitoring, when planning a staged rollout, or when you need a rollback strategy.
push-handoff
Commit and push a verified handoff plus its artifacts, only under explicit authority, and prove the push happened by reading the remote SHA back. Use as the final delivery step after artifacts are ready, when the user asks to push work, or when a handoff needs to reach the remote. Refuses to claim success without…
land
Drive open PRs to merged. Re-establish each PR's real state, resolve review threads, conflicts, failing checks, and CI failures under a bounded repair budget, land only the contiguous verified run bottom-up through the project's forge, watch until the checks pass and each merge lands, and stop at the ceiling. Use when…