Install
$ agentstack add skill-cogni-ai-ou-cogni-ai-agent-skills-dot-github ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Skill: dot-github
Standardize .github directory structure, enforce agentic documentation patterns.
When to Use
- When establishing or organizing the structure of the
.github/directory for a new repository. - To create or update
AGENTS.mddocumentation specifically for the workflows folder. - When you need to safely disable a workflow by moving it instead of deleting it.
When Not to Use
- For creating generic documentation outside of the
.github/folder (usedocs-writerinstead). - When configuring actual CI/CD pipeline logic inside the YAML files (use
github-actionsorgh-aw-syntax). - If you are managing organization-wide
.githubrepository templates and don't want to override them locally.
Common Pitfalls
- Creating
.github/README.md: Generating a README inside the.github/directory, which GitHub prioritizes and uses to completely overwrite the repository's main homepage. - Inventing CODEOWNERS: Guessing usernames or teams in the
CODEOWNERSfile instead of verifying their existence, rendering the file invalid and breaking PR approvals. - Destructive Deletion: Deleting a workflow file completely instead of moving it to
.github/workflows-disabled/, losing its history and configuration.
Core Principles
- Configuration Validation:
Validate .github/mcp-config.json if the file exists.
- Disabling Workflows:
To temporarily disable workflows, consider moving them to .github/workflows-disabled/.
- Do Not Invent CODEOWNERS:
Never guess or invent teams in CODEOWNERS when they are unknown. Only use verified, existing teams.
- Agentic Instructions (
AGENTS.md): - Use
.github/AGENTS.mdto describe the structure of the.githubdirectory and its contents (agents, instructions, prompts, skills). - Use
.github/workflows/AGENTS.mdto list workflows that can be triggered manually (crucial when the agent has actions write permissions). - Document available prompts in
.github/prompts/AGENTS.mdand specify when to load them. - Document instruction scopes in
.github/instructions/AGENTS.md. - Upstream Organization Fallbacks:
If an org/owner-level .github repository exists, follow its upstream guides instead of creating local duplicates (e.g., CONTRIBUTING.md, ISSUE_TEMPLATE/).
- Workflow Documentation:
Document the list of available workflows in .github/workflows/README.md.
Firewall
To document encountered restrictive firewall during runtime, this can be documented in .github/FIREWALL.md, e.g.
````markdown
Firewall Allowlist
If your agent runs behind a restrictive firewall, allow these hosts. Always check the official guidance for updates.
agents.md
aka.ms
gh.io
ghcr.io
github.com
img.shields.io
pkg-containers.githubusercontent.com
raw.githubusercontent.com
support.github.com
tldrlegal.com
uploads.github.com
user-images.githubusercontent.com
yaml-multiline.info
web.archive.org
Note: Keep the list sorted alphabetically for easier maintenance.
Reference:
````
Hardened NEVER List
- NEVER create
.github/README.md:
GitHub renders .github/README.md with the highest priority. Creating it will override the main README.md on the repository homepage and profile page.
- Do not break your own workflow:
Refactoring, such as removing required triggers, can prevent the workflow from being triggered again. Always be careful and double-check your changes to ensure the continuity of your own runtime workflow.
What to Avoid
- Creating undocumented workflows in
.github/workflows/. - Deleting workflows instead of moving them to
.github/workflows-disabled/. - Overwriting upstream organization defaults in
.github/repo.
Related Skills
- agents-md-writer: You MUST load this skill when creating or updating
AGENTS.mdfiles. - docs-writer: You MUST load this skill when asked to write, document, or generate new documentation.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Cogni-AI-OU
- Source: Cogni-AI-OU/cogni-ai-agent-skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.