Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsBlogPro
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Authors
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges
  • Chrome Extension
  • Skill Manager

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

ProTermsPrivacyRefunds
Back to skills

Github

ASecurity

Load before any git or GitHub work in a chat: committing model changes, pushing a branch, opening a pull request, updating a pull request, or commenting on one. Covers the sandbox git checkout, the signalpilot/ branch rule, and the open_pull_request, update_pull_request, and comment_on_pull_request tools.

485 stars
0 votes
0 copies
0 views
Added 9/24/2026
code-qualitygogit

Security Analysis

A100/100

Scanned 9/24/2026

$npx -y skills add SignalPilot-Labs/SignalPilot --skill github --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Github?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Github
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/signalpilot-labs-github/badge)](https://www.skillsdirectory.com/skills/signalpilot-labs-github)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
Files
SKILL.md
---
name: github
description: "Load before any git or GitHub work in a chat: committing model changes, pushing a branch, opening a pull request, updating a pull request, or commenting on one. Covers the sandbox git checkout, the signalpilot/ branch rule, and the open_pull_request, update_pull_request, and comment_on_pull_request tools."
type: skill
---

# GitHub: publish chat work as a pull request

The chat agent publishes work through git and pull requests. A person reviews
and merges on GitHub. The agent never merges.

## Where git runs

The sandbox VM holds the project at `/workspace`. `/workspace` is a git
repository. The remote `origin` is SignalPilot's git server, not GitHub.
Credentials are already configured. You do not need a token.

Run every git command with `sandbox_exec`. Set `cwd` to `/workspace`. Edit
files with `sandbox_write_file`. Do not edit files in your own working
directory. It is a frozen copy for reading only.

The system prompt names the base branch. Your commits go on top of that
branch.

## Branch rule

The server accepts a push only to a branch that starts with `signalpilot/`.
Use the form `signalpilot/<short-name>`. Use a short lowercase name with
hyphens that describes the change. Example: `signalpilot/fix-revenue-grain`.

Use one branch name for one piece of work. Push to the same name each time
you add commits.

The server refuses these pushes and prints the reason:

- A push to any branch that does not start with `signalpilot/`.
- A force push. Add a new commit instead.
- A branch deletion.
- A branch that another chat created. Use a new name.
- A new branch name that already exists on GitHub. Use a new name.
- Any push when the project is not linked to GitHub. Tell the user and give
  the diff in your answer instead.

## Steps to publish

1. Change the files in `/workspace` in the sandbox VM.
2. For model changes, run `dbt_execute` with `build` on the changed models.
   Fix errors until the build passes.
3. Check the diff: `git status` and `git diff`.
4. Stage and commit: `git add -A && git commit -m "<clear message>"`.
5. Push: `git push origin HEAD:signalpilot/<short-name>`.
6. Call `open_pull_request` with a title and a body. In the body, list the
   files or models you changed, what changed in each, and the build result.
7. Put the pull request URL from the tool result in your final answer.

## Pull request tools

- `open_pull_request(title, body, draft, branch)`: opens the pull request
  for the branch you pushed. Leave `branch` empty to use your most recent
  push. Set `draft` true for work that is not ready for review. If the
  branch already has an open pull request, the tool returns it.
- `update_pull_request(title, body, pr_number)`: changes the title or the
  body. Use it after you push more commits, so the description stays true.
- `comment_on_pull_request(body, pr_number)`: adds a comment. Use it to
  report a new build result, to answer a review comment, or to explain one
  part of the change in detail.

Every tool returns `pr_url`. Give the user that link. Every tool acts only
on branches and pull requests that this chat created.

## Good pull request messaging

- Title: one line, imperative, under 70 characters.
- Body: what changed, why, how you verified it, and what the reviewer
  should check.
- When the user asks for detailed explanations, put one topic per comment
  with `comment_on_pull_request`.

## Do not

- Do not run `git push --force`.
- Do not push to `main` or to any branch outside `signalpilot/`.
- Do not try to merge. There is no tool for it.
- Do not put tokens or credentials in commits, comments, or answers.

Attribution

SignalPilot-LabsSignalPilot-Labs
View sourceSee grades on GitHubMore from SignalPilot-Labs →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

Caveman Review

Ultra-compressed code review comments. Cuts noise from PR feedback while preserving the actionable signal. Each comment is one line: location, problem, fix. Use when user says "review this PR", "code review", "review the diff", "/review", or invokes /caveman-review. Auto-triggers when reviewing pull requests.

1100021 votes

Caveman Commit

Ultra-compressed commit message generator. Cuts noise from commit messages while preserving intent and reasoning. Conventional Commits format. Subject ≤50 chars, body only when "why" isn't obvious. Use when user says "write a commit", "commit message", "generate commit", "/commit", or invokes /caveman-commit. Auto-triggers when staging changes.

1100021 votes

Verification Loop

一个全面的 Claude Code 会话验证系统。

2456590 votes

Springboot Verification

Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.

2456590 votes

Django Verification

Verification loop for Django projects: migrations, linting, tests with coverage, security scans, and deployment readiness checks before release or PR.

2456590 votes
View all in code-quality →