diff --git a/plugins/engineering-playbook/skills/development/SKILL.md b/plugins/engineering-playbook/skills/development/SKILL.md
index 836e293..1557c98 100644
--- a/plugins/engineering-playbook/skills/development/SKILL.md
+++ b/plugins/engineering-playbook/skills/development/SKILL.md
@@ -21,6 +21,8 @@ source of truth.
   tracing.
 - Read `creating-skills` before creating or editing a skill or any file
   referenced by a skill.
+- Read `git-publishing` before publishing local changes through commit-and-push
+  or a pull request.
 - Read `pull-request` before creating or preparing a pull request.
 - Read `laravel-standards` before touching code that affects a
   Laravel application.
diff --git a/plugins/engineering-playbook/skills/git-publishing/SKILL.md b/plugins/engineering-playbook/skills/git-publishing/SKILL.md
new file mode 100644
index 0000000..3862f83
--- /dev/null
+++ b/plugins/engineering-playbook/skills/git-publishing/SKILL.md
@@ -0,0 +1,31 @@
+---
+name: git-publishing
+description: Commits and pushes completed changes and creates pull requests. Use when the user requests commit-and-push or a PR for local changes.
+---
+
+# Git Publishing
+
+## Runtime
+
+When running as `git-publisher`, read
+`references/git-publisher-agent.md` completely and follow it.
+
+## Workflow
+
+1. Invoke `git-publisher` only after implementation, review, and verification
+   when the user requests commit-and-push or a pull request.
+2. Give it the repository path, change scope, exact paths, and any requested PR
+   base or readiness.
+3. If unavailable, follow `references/git-publisher-agent.md` in this thread.
+
+Keep edits, verification, conflict resolution, and ambiguous scope decisions
+outside this agent.
+
+## Install the Custom Agent
+
+Copy `assets/git-publisher.toml` to one destination:
+
+- Repository: `<repository>/.codex/agents/git-publisher.toml`
+- Personal: `~/.codex/agents/git-publisher.toml`
+
+Do not overwrite without approval. Start a new Codex session after copying.
diff --git a/plugins/engineering-playbook/skills/git-publishing/assets/git-publisher.toml b/plugins/engineering-playbook/skills/git-publishing/assets/git-publisher.toml
new file mode 100644
index 0000000..6fc6dc8
--- /dev/null
+++ b/plugins/engineering-playbook/skills/git-publishing/assets/git-publisher.toml
@@ -0,0 +1,13 @@
+name = "git-publisher"
+description = "Commits, pushes, and opens pull requests for completed changes."
+model = "gpt-5.6-luna"
+model_reasoning_effort = "low"
+sandbox_mode = "workspace-write"
+
+developer_instructions = """
+You are git-publisher. Always use the installed `git-publishing` skill and
+follow its `Runtime` instructions completely.
+
+If unavailable, stop and tell the parent to install or update the Engineering
+Playbook plugin.
+"""
diff --git a/plugins/engineering-playbook/skills/git-publishing/references/git-publisher-agent.md b/plugins/engineering-playbook/skills/git-publishing/references/git-publisher-agent.md
new file mode 100644
index 0000000..614c4c3
--- /dev/null
+++ b/plugins/engineering-playbook/skills/git-publishing/references/git-publisher-agent.md
@@ -0,0 +1,35 @@
+# Git Publisher Agent
+
+Proceed only when the user requested both commit and push or a pull request,
+and the parent supplied the exact scope and paths. Stop on ambiguity, detached
+HEAD, or an unsafe branch or remote.
+
+## Safeguards
+
+- Never edit repository files or stage unrelated or sensitive content.
+- Stage only literal paths with `git add -- <path>...`. Never use broad staging,
+  wildcards, directory pathspecs, or `git commit -a`.
+- Never force push, rebase, reset, amend, clean, switch branches, change Git
+  configuration, bypass hooks, or unstage pre-existing changes.
+
+## Publication Workflow
+
+1. Inspect the root, branch, remotes, upstream, status, and full staged and
+   unstaged diffs. Read intended untracked files. Stop on unrelated, unclear,
+   or sensitive content such as secrets, keys, tokens, or non-example env
+   files, including unexpected staged changes. For a PR, first confirm `gh` is
+   available and authenticated and resolve its base branch.
+2. Stage only the supplied literal paths. Confirm the staged paths and full
+   diff exactly match the requested scope.
+3. Commit with a truthful Conventional Commit message and normal hooks. Stop if
+   a hook fails.
+4. Before pushing, confirm the commit matches the approved staged diff and no
+   hook changed repository files.
+5. Use `git push` when the verified upstream and Git configuration push only
+   the current branch. Otherwise use `git push <remote> HEAD:<branch>` only with
+   one unambiguous remote. Never force push.
+6. For a requested PR, read `pull-request`. Reuse an existing open PR for the
+   branch or create one with `gh pr create`, defaulting to draft unless the user
+   asked for ready. Verify it with `gh pr view`.
+7. Report the commit SHA, branch, pushed ref, final status, and PR URL and state
+   when applicable.