fatby/prepare-pr
skills/agent-prepare-pr/SKILL.md
Script-first PR preparation with structured findings resolution, deterministic push safety, and explicit gate execution.
$ install --global
skillsauthnpx skillsauth add fatby/duncrew prepare-prInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 4, 2026, 10:31 PM4.5s2 files scanned
SKILL.md
- name:
- prepare-pr
- description:
- Script-first PR preparation with structured findings resolution, deterministic push safety, and explicit gate execution.
- version:
- 1.0.0
- author:
- DunCrew
- emoji:
- 🔧
- primaryEnv:
- shell
Prepare PR
Overview
Prepare the PR head branch for merge after /review-pr.
Inputs
- Ask for PR number or URL.
- If missing, use
.local/pr-meta.envif present in the PR worktree.
Safety
- Never push to
main. - Only push to PR head with explicit
--force-with-leaseagainst known head SHA. - Do not run
git clean -fdx. - Wrappers are cwd-agnostic; run from repo root or PR worktree.
Execution Contract
- Run setup:
scripts/pr-prepare init <PR>
- Resolve findings from structured review:
.local/review.jsonis mandatory.- Resolve all
BLOCKERandIMPORTANTitems.
-
Commit scoped changes with concise subjects (no PR number/thanks; those belong on the final merge/squash commit).
-
Run gates via wrapper.
-
Push via wrapper (includes pre-push remote verification, one automatic lease-retry path, and post-push API propagation retry).
Optional one-shot path:
scripts/pr-prepare run <PR>
Steps
- Setup and artifacts
scripts/pr-prepare init <PR>
ls -la .local/review.md .local/review.json .local/pr-meta.env .local/prep-context.env
jq . .local/review.json >/dev/null
- Resolve required findings
List required items:
jq -r '.findings[] | select(.severity=="BLOCKER" or .severity=="IMPORTANT") | "- [\(.severity)] \(.id): \(.title) => \(.fix)"' .local/review.json
Fix all required findings. Keep scope tight.
- Update changelog/docs (changelog is mandatory in this workflow)
jq -r '.changelog' .local/review.json
jq -r '.docs' .local/review.json
- Commit scoped changes
Use concise, action-oriented subject lines without PR numbers/thanks. The final merge/squash commit is the only place we include PR numbers and contributor thanks.
Use explicit file list:
scripts/committer "fix: <summary>" <file1> <file2> ...
- Run gates
scripts/pr-prepare gates <PR>
- Push safely to PR head
scripts/pr-prepare push <PR>
This push step includes:
- robust fork remote resolution from owner/name,
- pre-push remote SHA verification,
- one automatic rebase + gate rerun + retry if lease push fails,
- post-push PR-head propagation retry,
- idempotent behavior when local prep HEAD is already on the PR head,
- post-push SHA verification and
.local/prep.envgeneration.
- Verify handoff artifacts
ls -la .local/prep.md .local/prep.env
- Output
- Summarize resolved findings and gate results.
- Print exactly:
PR is ready for /merge-pr.
Guardrails
- Do not run
gh pr mergein this skill. - Do not delete worktree.
Related Skills
fatby/web-search
tools
VerifiedTrustedCommunity
Use the webSearch tool to find information online.
3SKILL.mdUpdated Apr 4, 2026
fatby/weather
development
VerifiedTrustedCommunity
Query weather information for any location.
3SKILL.mdUpdated Apr 4, 2026
fatby/wacli
tools
VerifiedTrustedCommunity
Send WhatsApp messages to other people or search/sync WhatsApp history via the wacli CLI (not for normal user chats).
3SKILL.mdUpdated Apr 4, 2026
fatby/voice-call
tools
VerifiedTrustedCommunity
Start voice calls via the OpenClaw voice-call plugin.
3SKILL.mdUpdated Apr 4, 2026