スキル merge-open-prs

📦

merge-open-prs

Name: merge-open-prs
Author: jssblck

コンテンツリビジョン r1 安全 ⚙️ 外部コマンド

Merge Open Pull Requests as One Stack

Merging several open pull requests together requires careful ordering, conflict handling, and repeated verification. This skill builds one GitHub stack and merges it through repository protections.

対応: Claude Codex Code(CC)

📊 73 十分

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "merge-open-prs" from https://skillstore.io/skills/jssblck-merge-open-prs.md and its manifest at https://skillstore.io/api/skills/jssblck-merge-open-prs/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/jssblck-merge-open-prs.md 署名済み manifest GET /api/skills/jssblck-merge-open-prs/manifest 署名済み lockfile GET /api/skills/jssblck-merge-open-prs/lockfile

テストする

「merge-open-prs」を使用しています。 Merge pull requests 41, 44, and 47.

期待される結果:

Merged stack 18 in the order 44, 41, 47. All required checks passed, no later pull requests were included, and the final branch SHA was reported.

「merge-open-prs」を使用しています。 Merge every open pull request, but do not rewrite branches owned by other contributors.

期待される結果:

Stopped before stack creation because two branches required rewriting. The report identified both branches and requested explicit approval.

「merge-open-prs」を使用しています。 Land the open release pull requests after resolving conflicts.

期待される結果:

Resolved the lockfile and version conflicts on their owning layers, verified the combined tree, and merged the stack through the configured repository method.

セキュリティ監査

安全

v1 • 2026/8/23 バージョン別レポートを開く

Most static alerts are false positives caused by Markdown code fences, inline command names, or read-only GitHub queries. Seven findings are confirmed because the workflow can rewrite branches, push rebased commits, prune local state, and merge pull requests; the unquoted branch placeholders also create a command-injection risk.

スキャンされたファイル

259

解析済み行数

レビュー項目

誤検知を無視

機能レビュー項目 (7)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

SKILL.md:115-126

Ruby/shell backtick execution

```sh

This shell block rebases and submits multiple branches, which can force-push remote pull request branches. Branch placeholders also appear as unquoted loop words, allowing shell metacharacters in a crafted branch name to alter the command.

中

SKILL.md:133-135

Ruby/shell backtick execution

```sh

The fenced gh stack sync command performs a cascade rebase and pushes updated branches. That is a real repository mutation with impact across every stack layer.

中

SKILL.md:137

Ruby/shell backtick execution

`sync` cascade-rebases and pushes. Exit 3 is a conflict (run `gh stack rebase`,

The instructions explicitly state that sync cascade-rebases and pushes branches. Although shown as inline Markdown, this is a real mutating operation the agent is directed to run.

中

SKILL.md:146-147

Ruby/shell backtick execution

Fix a layer's conflict on that layer, then `gh stack rebase --upstack`; do not

The workflow directs the agent to rebase every branch above a conflicted layer. This can rewrite and push several pull request branches, so it is a genuine mutating external command risk.

中

SKILL.md:168-170

Ruby/shell backtick execution

```sh

The fenced command merges the entire verified stack into the default branch. It is authorized by the skill request and repository gates, but it is a high-impact remote state change.

中

SKILL.md:175-179

Ruby/shell backtick execution

`gh stack sync --prune` and remove the worktree.

The agent is directed to prune synchronized branches and remove a worktree after merging. These are intended cleanup actions, but they delete local repository state and require correct target selection.

中

SKILL.md:179-182

Ruby/shell backtick execution

```sh

The single-pull-request path merges remote code and deletes the source branch. The head-SHA match reduces races, but the command still performs an irreversible repository mutation.

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/jssblck-merge-open-prs/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/jssblck-merge-open-prs/security.svg)](https://skillstore.io/skills/jssblck-merge-open-prs?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/jssblck-merge-open-prs?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/jssblck-merge-open-prs/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/jssblck-merge-open-prs.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

jssblck. (2026). merge-open-prs security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/jssblck-merge-open-prs/audits/1

BibTeX形式の引用

@techreport{jssblck-jssblck-merge-open-prs-2026,
  author = {jssblck},
  title = {merge-open-prs security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/jssblck-merge-open-prs/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "merge-open-prs security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "jssblck"
date-released: "2026-08-23"
url: "https://skillstore.io/skills/jssblck-merge-open-prs/audits/1"
identifiers:
  - type: other
    value: "skillstore:jssblck-merge-open-prs:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Land a coordinated feature set

Combine dependent pull requests into a verified stack and merge them as one repository change.

Clear a release queue

Order approved release pull requests, resolve shared-state conflicts, and verify the final release tree.

Integrate maintenance updates

Process related dependency, configuration, and tooling pull requests while preserving checks and review requirements.

これらのプロンプトを試す

Merge every open pull request

Merge all currently open pull requests in this repository as one verified stack. Stop before rewriting branches that need separate approval.

Merge selected pull requests

Merge pull requests {numbers} as one stack. Explain the order, verify required checks, and ignore pull requests opened after the snapshot.

Resolve and merge a conflicting stack

Build a stack from pull requests {numbers}. Resolve textual and semantic conflicts by layer, run relevant tests, then merge once.

Manage a moving release stack

Merge pull requests {numbers} using merge method {method}. Revalidate after default-branch changes, preserve head SHAs, and report every rewrite or bypass.

ベストプラクティス

Freeze the work set and record every pull request head SHA before changing stack state.
Confirm stack membership, branch tips, checks, and repository policies immediately before merging.
Use a temporary worktree and disclose every branch rewrite, conflict resolution, and administrative action.

回避

Do not add pull requests that opened after the initial snapshot.
Do not push directly to the default branch or merge a multi-pull-request set individually.
Do not rewrite contributor branches or use administrative bypass without explicit approval.

よくある質問

Does this skill merge every open pull request automatically?

It snapshots all open pull requests unless you name a subset. Later arrivals are excluded from the work set.

Can it merge pull requests from forks?

Native stack creation requires branches in one repository. Fork pull requests require the documented fallback and suitable permissions.

How does it choose stack order?

User direction wins. Otherwise, isolated foundations go lower, dependencies follow them, and shared-state changes stay near the top.

Will it bypass required checks or reviews?

No. Repository rules, required checks, reviews, strict update policies, and merge queues continue to control the merge.

What happens when conflicts occur?

It resolves conflicts on the owning layer, rebases layers above it, and reruns checks for the combined result.

Does it require approval before changing branches?

It requires explicit approval before rewriting branches you do not own. Administrative merge bypass also requires explicit approval and disclosure.

開発者情報

作成者

jssblck

ライセンス

MIT

Skillstore リビジョン

バージョンに関する注意

作者はバージョンを宣言していません。

リポジトリ

https://github.com/jssblck/agents/tree/4658295e88faed205cc134edf987f7ea4e0c8ea4/skills/merge-open-prs

参照

f99743a72a3c357bb0508ce8373d2f57b334d465

メンテナンスの新しさ

2026/8/23

利用状況

0 ダウンロード · 0 閲覧

ファイル構成

📁 agents/

📄 openai.yaml

📁 references/

📄 conflicts.md

📄 fallback-collapse.md

📄 SKILL.md

jssblck のその他のスキル

すべて表示

📦

ship-it

Ship Changes Through Pull Requests and CI

Finishing a change requires careful verification, commits, pull-request setup, and CI follow-through. This skill manages that workflow until every check passes.

DevOps＆インフラ表示

📦

stop-slop

Remove Machine-Written Tells from Durable Prose

Durable prose can sound generic when rhetoric obscures concrete facts. This skill removes formulaic patterns while preserving meaning, technical details, and voice.

ライティング＆コンテンツ表示

📦

gh-stack

Manage Stacked Pull Requests with gh-stack

Dependent pull requests are difficult to organize, update, and merge safely. This skill guides reliable gh-stack workflows for linear branch stacks.

DevOps＆インフラ表示

📦

parallel-agents

Coordinate Parallel Agents With Fewer Conflicts

Parallel coding agents often collide in shared files and documentation. This skill provides structural and editing practices that reduce merge conflicts.

コーディング＆開発表示

📦

code-craft

Build Reliable Code with Durable Principles

Inconsistent engineering choices make code harder to review and maintain. This skill applies clear design, testing, error, and tooling defaults across common languages.

コーディング＆開発表示

📦

using-sops

Manage SOPS Secrets in Repositories

Encrypted repository secrets require careful commands, keys, and environment handling. This skill guides SOPS workflows through an existing pnpm secrets wrapper.

セキュリティ＆コンプライアンス表示

すべて表示

📦

github-cli

gh で GitHub コンテキストを収集

作成者 BfdCampos

GitHub での作業では、ローカルの git では確認できない PR、issue、レビュー、CI のコンテキストが必要になることがよくあります。このスキルは、Claude、Codex、Claude Code がより豊富なコンテキストを得るために gh の読み取りコマンドを使用するようガイドします。

DevOps＆インフラ表示

📦