Skills merge-open-prs

📦

merge-open-prs

Name: merge-open-prs
Author: jssblck

Content revision r1 Safe ⚙️ External commands

Merge Open Pull Requests as One Stack

Merging several open pull requests together requires careful ordering, conflict handling, and repeated verification. This skill builds one GitHub stack and merges it through repository protections.

Supports: Claude Codex Code(CC)

📊 73 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "merge-open-prs" from https://skillstore.io/skills/jssblck-merge-open-prs.md and its manifest at https://skillstore.io/api/skills/jssblck-merge-open-prs/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/jssblck-merge-open-prs.md Signed manifest GET /api/skills/jssblck-merge-open-prs/manifest Signed lockfile GET /api/skills/jssblck-merge-open-prs/lockfile

Test it

Using "merge-open-prs". Merge pull requests 41, 44, and 47.

Expected outcome:

Merged stack 18 in the order 44, 41, 47. All required checks passed, no later pull requests were included, and the final branch SHA was reported.

Using "merge-open-prs". Merge every open pull request, but do not rewrite branches owned by other contributors.

Expected outcome:

Stopped before stack creation because two branches required rewriting. The report identified both branches and requested explicit approval.

Using "merge-open-prs". Land the open release pull requests after resolving conflicts.

Expected outcome:

Resolved the lockfile and version conflicts on their owning layers, verified the combined tree, and merged the stack through the configured repository method.

Security Audit

Safe

v1 • 8/23/2026 Open versioned report

Most static alerts are false positives caused by Markdown code fences, inline command names, or read-only GitHub queries. Seven findings are confirmed because the workflow can rewrite branches, push rebased commits, prune local state, and merge pull requests; the unquoted branch placeholders also create a command-injection risk.

Files scanned

259

Lines analyzed

Review items

False positives ignored

Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:115-126

Ruby/shell backtick execution

```sh

This shell block rebases and submits multiple branches, which can force-push remote pull request branches. Branch placeholders also appear as unquoted loop words, allowing shell metacharacters in a crafted branch name to alter the command.

Medium

SKILL.md:133-135

Ruby/shell backtick execution

```sh

The fenced gh stack sync command performs a cascade rebase and pushes updated branches. That is a real repository mutation with impact across every stack layer.

Medium

SKILL.md:137

Ruby/shell backtick execution

`sync` cascade-rebases and pushes. Exit 3 is a conflict (run `gh stack rebase`,

The instructions explicitly state that sync cascade-rebases and pushes branches. Although shown as inline Markdown, this is a real mutating operation the agent is directed to run.

Medium

SKILL.md:146-147

Ruby/shell backtick execution

Fix a layer's conflict on that layer, then `gh stack rebase --upstack`; do not

The workflow directs the agent to rebase every branch above a conflicted layer. This can rewrite and push several pull request branches, so it is a genuine mutating external command risk.

Medium

SKILL.md:168-170

Ruby/shell backtick execution

```sh

The fenced command merges the entire verified stack into the default branch. It is authorized by the skill request and repository gates, but it is a high-impact remote state change.

Medium

SKILL.md:175-179

Ruby/shell backtick execution

`gh stack sync --prune` and remove the worktree.

The agent is directed to prune synchronized branches and remove a worktree after merging. These are intended cleanup actions, but they delete local repository state and require correct target selection.

Medium

SKILL.md:179-182

Ruby/shell backtick execution

```sh

The single-pull-request path merges remote code and deletes the source branch. The head-SHA match reduces races, but the command still performs an irreversible repository mutation.

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/jssblck-merge-open-prs/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/jssblck-merge-open-prs/security.svg)](https://skillstore.io/skills/jssblck-merge-open-prs?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/jssblck-merge-open-prs?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/jssblck-merge-open-prs/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/jssblck-merge-open-prs.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

jssblck. (2026). merge-open-prs security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/jssblck-merge-open-prs/audits/1

BibTeX citation

@techreport{jssblck-jssblck-merge-open-prs-2026,
  author = {jssblck},
  title = {merge-open-prs security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/jssblck-merge-open-prs/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "merge-open-prs security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "jssblck"
date-released: "2026-08-23"
url: "https://skillstore.io/skills/jssblck-merge-open-prs/audits/1"
identifiers:
  - type: other
    value: "skillstore:jssblck-merge-open-prs:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Land a coordinated feature set

Combine dependent pull requests into a verified stack and merge them as one repository change.

Clear a release queue

Order approved release pull requests, resolve shared-state conflicts, and verify the final release tree.

Integrate maintenance updates

Process related dependency, configuration, and tooling pull requests while preserving checks and review requirements.

Try These Prompts

Merge every open pull request

Merge all currently open pull requests in this repository as one verified stack. Stop before rewriting branches that need separate approval.

Merge selected pull requests

Merge pull requests {numbers} as one stack. Explain the order, verify required checks, and ignore pull requests opened after the snapshot.

Resolve and merge a conflicting stack

Build a stack from pull requests {numbers}. Resolve textual and semantic conflicts by layer, run relevant tests, then merge once.

Manage a moving release stack

Merge pull requests {numbers} using merge method {method}. Revalidate after default-branch changes, preserve head SHAs, and report every rewrite or bypass.

Best Practices

Freeze the work set and record every pull request head SHA before changing stack state.
Confirm stack membership, branch tips, checks, and repository policies immediately before merging.
Use a temporary worktree and disclose every branch rewrite, conflict resolution, and administrative action.

Avoid

Do not add pull requests that opened after the initial snapshot.
Do not push directly to the default branch or merge a multi-pull-request set individually.
Do not rewrite contributor branches or use administrative bypass without explicit approval.

Frequently Asked Questions

Does this skill merge every open pull request automatically?

It snapshots all open pull requests unless you name a subset. Later arrivals are excluded from the work set.

Can it merge pull requests from forks?

Native stack creation requires branches in one repository. Fork pull requests require the documented fallback and suitable permissions.

How does it choose stack order?

User direction wins. Otherwise, isolated foundations go lower, dependencies follow them, and shared-state changes stay near the top.

Will it bypass required checks or reviews?

No. Repository rules, required checks, reviews, strict update policies, and merge queues continue to control the merge.

What happens when conflicts occur?

It resolves conflicts on the owning layer, rebases layers above it, and reruns checks for the combined result.

Does it require approval before changing branches?

It requires explicit approval before rewriting branches you do not own. Administrative merge bypass also requires explicit approval and disclosure.

Developer Details

Author

jssblck

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/jssblck/agents/tree/4658295e88faed205cc134edf987f7ea4e0c8ea4/skills/merge-open-prs

Ref

f99743a72a3c357bb0508ce8373d2f57b334d465

Maintenance freshness

8/23/2026

Usage

0 downloads · 0 views

File structure

📁 agents/

📄 openai.yaml

📁 references/

📄 conflicts.md

📄 fallback-collapse.md

📄 SKILL.md

merge-open-prs

Install with my Agent

Agent-readable resources

Test it

Security Audit

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Land a coordinated feature set

Clear a release queue

Integrate maintenance updates

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details