- Installs
- 556
- Last 24h
- +37
- Trending rank
- #4026
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/warpdotdev/common-skills --skill merge-risk- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads merge-risk automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Output format:
**Merge risk: <low-medium-high>**
**<category>:** <verdict>
<list gaps that increase risk. Use bullets, keep succinct. Include links to relevant files as needed>
<...list all categories>
These are the categories and verdicts that affect risk, with descriptions of what "low risk" means:
- Alignment (poor ⚠️ / decent 👀 / good ✅): Code aligns with the description and source issue, when present. Behavior assumptions and drive-bys must be documented.
- Impact (large ⚠️ / medium 👀 / small ✅): Scope is contained and away from sensitive code paths.
- Consider blast radius: potential impact or scope of the changes introduced by this PR. Consider all possibilities. Examples are layout shift, breakages for consumers, mobile responsiveness, etc.
- Sensitive areas carry outsized risk regardless of diff size: auth, permissions, payments, PII, secrets, data migrations, dependency bumps, and infra or config changes. Flag any that are touched, and call out anything that widens access, weakens validation, or logs sensitive data.
- Verification (poor ⚠️ / decent 👀 / good ✅): Behavior is verified, where applicable.
- Changes to the user experience need end-to-end proof as screenshots or recordings. Changes that could meaningfully affect performance need profiling. Prefer before-and-after evidence to standalone proof. When this coverage is lacking, it's a failure.
- Edge cases must be tested, or documented when they aren't; review the code closely and link the user to relevant code when only documentation is present.
- Rollback cost (high ⚠️ / medium 👀 / low ✅): The code is reversible once merged. Consider one-way vs. two-way doors. You can walk back through two-way doors, but not one-way doors. A PR that is cheap to roll back is lower risk. Changes that involve destructive actions or hard-to-reverse decisions are one-way doors.
- Error detection (poor ⚠️ / decent 👀 / good ✅ / N/A ✅): If applicable, critical flows should be monitored; If this breaks in production, someone should find out before users report it. Look for swallowed errors or fallbacks that hide breakage.
Generate a risk score for merging this PR on a scale of low - medium - high.
Verdicts:
- ⚠️ = 3
- 👀 = 2
- ✅ = 1
Weights:
- Impact = 2x
- Verification = 2x
- Rollback cost = 1.5x
- Error detection = 1x
- Alignment = 1x
Score = Σ(score × weight) / Σ(weights).
- low: < 1.5
- medium: 1.5 – < 2.25
- high: ≥ 2.25
Keep the numerical score and its calculations internal; do not include them in the output.
FAQ
What does the merge-risk skill do?
Use when assessing the risk of merging a PR
How do I install merge-risk?
Run npx skills add https://github.com/warpdotdev/common-skills --skill merge-risk in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/merge-risk/ (personal) or .claude/skills/merge-risk/ (project).
Which AI agents can use merge-risk?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is merge-risk safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains merge-risk?
It is published by warpdotdev in warpdotdev/common-skills. It has 556 recorded installs.
More from warpdotdev/common-skills
review-pr
warpdotdev/common-skills
Review a pull request diff and write structured feedback to review.json for the workflow to publish. Use when reviewing a checked-out PR from local artifacts like prdiff.txt and prdescription.txt and producing machine-readable review output instead of posting directly to GitHub.
spec-driven-implementation
warpdotdev/common-skills
Drive a spec-first workflow for substantial features by writing PRODUCT.md before implementation, writing TECH.md when warranted, and keeping both specs updated as implementation evolves. Use when starting a significant feature, planning agent-driven implementation, or when the user wants product and tech specs checked into source control.
write-product-spec
warpdotdev/common-skills
Write a PRODUCT.md spec for a significant user-facing feature in Warp, focused on detailed behavior and validation. Use when the user asks for a product spec, desired behavior doc, or PRD, wants to define feature behavior before implementation, or when the feature is substantial or behaviorally ambiguous enough that a written spec would improve implementation or review.
write-tech-spec
warpdotdev/common-skills
Write a TECH.md spec for a significant Warp feature after researching the current codebase and implementation constraints. Use when the user asks for a technical spec, implementation plan, or architecture doc tied to a product spec.
resolve-merge-conflicts
warpdotdev/common-skills
Resolve Git merge conflicts by extracting only unresolved paths, conflict hunks, and compact diffs instead of loading whole files into context. Use when a merge, rebase, cherry-pick, or stash pop stops on conflicts, when git status shows unmerged paths, or when files contain conflict markers.
fix-errors
warpdotdev/common-skills
Fix compilation errors, linting issues, and test failures in the warp Rust codebase. Covers presubmit checks, WASM-specific errors, and running specific tests. Use when the user hits build errors, clippy or fmt failures, test failures, or needs to run or interpret presubmit before a PR.
Popular code quality & workflow skills
grill-me
mattpocock/skills
A relentless interview to sharpen a plan or design.
improve-codebase-architecture
mattpocock/skills
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
handoff
mattpocock/skills
Compact the current conversation into a handoff document for another agent to pick up.
domain-modeling
mattpocock/skills
Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
codebase-design
mattpocock/skills
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
diagnosing-bugs
mattpocock/skills
Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.