GitHub Operation

Use this capability whenever you read or write GitHub from inside an agent session that acts as a single connected operator — the model a Claude Code session using the GitHub MCP server, or a Codex session using its own GitHub channel, operates under. It applies to a session with no GitHub tool at all too, since what such a session may reach for instead is itself one of these rules. It is workflow-agnostic: any task that touches an issue, pull request, comment, label, review, or branch applies it, not only end-to-end change loops. The examples name the mcp__github__* tools provided by the connected GitHub MCP server; on a different agent that operates GitHub the same way, substitute its equivalent sanctioned channel.

This capability is GitHub-specific. Operating a different host (GitLab, Gitea, …) shares the shape of these rules — a default sanctioned channel, agent-comment markers, distinct issue/PR targets, untrusted input — but the concrete API semantics below (label replacement, review-event rejection) are GitHub's; re-derive them for another host rather than assuming they carry over.

This skill is self-contained: it names no repository-specific file, command, or layout, and the operating model it carries is the same wherever it is installed. Where a host project defines its own agent-comment marker, push-allowed branch namespace, merge strategy, Conventional Commits practices, or pull-request-description rules, follow the host's convention on that point and keep the structure below.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

The Sanctioned Channel

These rules govern GitHub access from inside an agent session, where access is mediated as the connected operator; an in-session write cannot act as a distinct bot identity. A CI job — such as a review workflow — is a separate execution context: it uses its own CI token and posts under its own bot login (see Agent-vs-Human Comments), so these in-session tool rules do not apply to it.

The Default Route

The harness's own GitHub tool channel is where every read and write goes unless one of the conditions below takes it out of play. It is the route the operator's access was configured for, and its calls are shaped like the operations they perform rather than like the API underneath them.

Guidelines: