skills.rest
diazMelgarejo
diazMelgarejoCOMMUNITY
Explore all skills by this author →
Website𝕏@Melgarejo_yDiazGitHub

cursor-pr-body

Enforces comment-only PR updates and HMAC-granted append-only body edits for Cursor agents.

Updated Mar 22, 2026
Search Tags:#pull request#github#gh cli#cursor#append-only#hmac#agent guardrails
One-click install
npx skills add https://github.com/diazMelgarejo/orama-system --skill cursor-pr-body-diazmelgarejo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cursor-pr-body
Source: https://github.com/diazMelgarejo/orama-system/tree/main/bin/orama-system/skills/cursor-pr-body
Command: npx skills add https://github.com/diazMelgarejo/orama-system --skill cursor-pr-body-diazmelgarejo

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? AI coding agents can accidentally clobber pull request descriptions by writing delta-only bodies or calling update_pr directly, destroying existing summaries and follow-up notes. This Skill enforces a comment-only default and a cryptographically authorized append-only write path so PR bodies are never silently overwritten. ## Core Features & Use Cases - Layer 0 comment-only enforcement: Agents use post_comment or gh pr comment only; hooks block update_pr with body= and gh pr edit at preToolUse, beforeMCPExecution, and beforeShellExecution. - Operator grant v2 authorization: An HMAC-authenticated capability (operator-grant-v2) minted from an operator TTY binds a nonce, timestamp, and content digest to authorize exactly one append. - Append-only replay state machine: append-pr-body.sh runs verify, reconcile, reserve, READ, BACKUP, MERGE, gh pr edit, mark-applied, consume, with crash recovery and digest mismatch detection. - Use Case: After rebasing a stacked PR, an operator mints a grant for a follow-up note, and the agent appends a "Follow-up: harmonized onto #244" section without touching the original summary or CodeRabbit release notes. ## Quick Start Ask the agent to post a PR comment with your update, or after the operator mints a grant with grant-pr-body-human-override.sh, run append-pr-body.sh with the same follow-up file to append the note to the PR body.

Frequently Asked Questions about cursor-pr-body

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely update a GitHub PR body from a Cursor agent?▼

By default, agents must use post_comment or gh pr comment only. To edit the body, an operator first mints an operator-grant-v2 with grant-pr-body-human-override.sh, then the agent runs append-pr-body.sh with the same file to append content without overwriting existing sections.

What is operator-grant-v2 and how does it authorize PR body edits?▼

operator-grant-v2 is an HMAC-authenticated capability stored in ~/.cursor/pr-body-human-override-ack, binding repo, PR number, nonce, timestamp, action, and content digest. It replaces the rejected v1 plaintext ack and environment variable overrides, and only permits writes through append-pr-body.sh.

Can agents use gh pr edit or ManagePullRequest update_pr directly?▼

No. Hooks at beforeMCPExecution and beforeShellExecution block update_pr with body= and inline gh pr edit --body calls, even after a grant is minted. The grant authorizes only the append-pr-body.sh script, never direct API or CLI body mutations.

Why does append-pr-body.sh fail with content-digest mismatch?▼

The grant is cryptographically bound to the exact bytes of the follow-up file or message at mint time. If the content changed after minting, the digest no longer matches and the append is rejected; re-mint the grant with the current file.

What happens if gh pr edit fails during an append?▼

The reserved nonce is released rather than consumed, and the merged body can be saved under .git/pr-body-backups/ for operator handoff. On retry, the reconcile step detects if the follow-up block already exists remotely and consumes the grant without a duplicate edit.

Related Skills

Explore More Software Engineering Skills→
EveryIncEveryInc
24.7k

ce-commit-push-pr

Commit changes, push branches, and create or update GitHub pull requests with composed descriptions.

Official
Advanced
JakeintechJakeintech
1

sync

Reconciles a waybill ledger with tracker issues and merged pull requests from Jira and GitHub.

Community
Advanced
SyloReiSyloRei
3

ship

Automate pre-push verification, security scans, and PR creation with Git and GitHub CLI.

Community
Advanced
try-workstry-works
95

agent/skills/pr

Create and edit GitHub pull requests with generated titles and descriptions.

Community
Intermediate