The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands via git and gh (GitHub CLI) to manage branch states and interact with GitHub's PR system. These commands are scoped to the active repository and are gated by mandatory user approval checkpoints.
Evidence: SKILL.md uses push, gh pr create, gh pr update, gh pr ready, and gh pr edit.
Evidence: references/split-to-stack.md uses gh stack init, gh stack submit, gh stack view, git restore, git commit, and git rev-parse.
Evidence: references/artifact-paths.md uses git ls-files and git check-ignore.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data sources that could contain malicious instructions. It mitigates this surface by enforcing structured previews and manual verification steps.
Ingestion points: Pull request templates found in .github/, docs/, or the root directory; repository context files (CONTEXT.md, CONTEXT-MAP.md); and browser-rendered text (document.body.innerText).
Boundary markers: Instructions in references/pr-body.md require preserving HTML comments and template headings; SKILL.md defines a clear publication boundary.
Capability inventory: The skill performs remote writes (git push, gh pr create) and local file writes to the .tigerkit/ directory.
Sanitization: The skill requires presenting a 'Publication approval packet' (defined in references/approval-packet.md) to the user, providing a rendered preview of the final PR content for verification before execution.
[EXTERNAL_DOWNLOADS]: The skill recommends using the official github/gh-stack extension for complex workflows. It explicitly prohibits the agent from automatically installing the extension, instead directing the user to perform the installation manually if the tool is missing from the verified source repository.
[SAFE]: The skill follows security best practices for handling sensitive information. Authentication tokens are stored in worktree-local directories (.tigerkit/secret-input/) with highly restrictive filesystem permissions (0700 for directories, 0600 for files) and are protected from accidental inclusion in version control via mandatory Git ignore checks.

tk-pr-open