github-kernel
Provides the foundational rules and safety protocols for all GitHub-related agent operations.
Install
mkdir -p .claude/skills/github-kernel && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/14910" && unzip -o skill.zip -d .claude/skills/github-kernel && rm skill.zipInstalls to .claude/skills/github-kernel
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
foundational definitions for GitHub skills, safety rules, tool escalation, and security boundariesKey capabilities
- →Explain the Tool Escalation Ladder for GitHub actions
- →Define safety rules for destructive GitHub operations
- →Map abstract capabilities to concrete MCP tools
- →Establish conventions for branch naming and commit messages
- →Provide guidance on selecting the right tool for GitHub interactions
- →Determine if a GitHub action requires user confirmation
How it works
The skill acts as a passive reference, defining foundational rules and strategies for GitHub interactions, including a Tool Escalation Ladder, Safety Rules, and conventions for various GitHub elements.
Inputs & outputs
When to use github-kernel
- →Verifying safety of an operation
- →Checking tool escalation procedures
- →Consulting commit message conventions
About this skill
What is it?
The GitHub Kernel is the foundational skill that defines the "laws of physics" for all other GitHub capability skills. It provides the central source of truth for:
- Tool selection strategy (Escalation Ladder).
- Safety boundaries and non-negotiable rules.
- Conventions for interactions with the GitHub platform.
- Mapping of abstract capabilities to concrete MCP tools.
Success Criteria
- Foundational rules are applied across all other GitHub skills.
- The Tool Escalation Ladder is followed consistently.
- Safety rules for destructive operations are respected.
- Interaction conventions (naming, commits) are maintained.
When to use this skill
- Consult this skill for foundational knowledge when initializing a GitHub-related session.
- Refer to this skill whenever you are unsure about which tool to use (MCP vs. CLI vs. API).
- Consult this skill to check if an action is considered "safe" or requires user confirmation.
What this skill can do
- Explain the Tool Escalation Ladder.
- Define Safety Rules for destructive operations.
- Map capabilities to specific MCP Tools.
- Establish consistent conventions for branch naming, commit messages, and PR titles (see CONVENTIONAL_COMMITS.md).
What this skill will NOT do
- Execute any GitHub actions. This skill is purely informational.
- Create issues or PRs.
- Modify repository state.
- Interact with the API directly.
How to use this skill
This skill is a passive reference.
- Read the reference documents to understand the operating parameters.
- Apply the rules when executing other skills like
github-issuesorgithub-pr-flow.
Tool usage rules
All GitHub skills must adhere to the Escalation Ladder:
- Primary: Use GitHub MCP Tools (fast, safe, context-aware).
- Fallback: Use
ghCLI (if MCP is missing/broken). - Last Resort: Use REST API (only for edge cases like metadata fields).
See TOOL_ESCALATION.md for detailed logic.
Examples
Determining Tool Safety
"I need to delete a file. Is this safe?" Check
SAFETY_RULES.md-> Destructive operation -> Requires explicit confirmation.
Selecting the Right Tool
"I need to comment on an issue." Check
MCP_TOOL_MAP.md->add_issue_commentis available -> Use MCP.
Limitations
- Does not enforce rules programmatically; agents must voluntarily adhere to these guidelines.
- Does not contain specific workflow logic for complex tasks (like "release management").
When not to use it
- →When executing any GitHub actions
- →When creating issues or PRs
- →When modifying repository state
Limitations
- →Does not execute any GitHub actions
- →Does not create issues or PRs
- →Does not modify repository state
How it compares
This approach centralizes the 'laws of physics' for GitHub interactions, providing a consistent framework for all other GitHub skills, unlike ad-hoc tool selection or unstandardized conventions.
Compared to similar skills
github-kernel side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| github-kernel (this skill) | 0 | 7mo | No flags | Beginner |
| security-ownership-map | 2 | 6mo | Review | Advanced |
| github-archive | 1 | 4mo | Review | Advanced |
| auditing-pre-release-security | 1 | 1mo | Review | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
security-ownership-map
openai
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.
github-archive
gadievron
Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery. Use when verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines. Provides immutable forensic evidence of all public GitHub events since 2011.
auditing-pre-release-security
OneKeyHQ
Audits security and supply-chain risk between two git refs, 预发布安全审计
security-scan
redpanda-data
Resolve npm dependency vulnerabilities detected by security scans.
windsurf-dependency-management
jeremylongshore
Analyze and update dependencies with vulnerability scanning. Activate when users mention "update dependencies", "security audit", "npm audit", "vulnerability scan", or "dependency updates". Handles dependency analysis and updates. Use when working with windsurf dependency management functionality. Trigger with phrases like "windsurf dependency management", "windsurf management", "windsurf".
github-recon
zebbern
Scan Git repositories, GitHub organizations, and source code for leaked secrets, API keys, credentials, and sensitive data. Use when analyzing source code security, when checking for credential exposure, or when the user mentions secret scanning or credential leaks.