Alvis GitHub CLI

Use the GitHub CLI (gh) to perform core GitHub operations: auth status, repo create/clone/fork, issues, pull requests, releases, and basic repo management. T...

Security Scan

The skill is internally consistent with its stated purpose (guiding use of the GitHub CLI) and does not request unrelated credentials or install steps, though it omits an explicit declaration that the gh binary must be present and authenticated.

Purpose & Capability

Name, description, and SKILL.md consistently describe using the GitHub CLI (gh) for repo, issue, PR, and release workflows. However, the skill metadata does not declare that the gh binary is required; SKILL.md assumes gh is available and authenticated.

Instruction Scope

Instructions are narrowly scoped to running gh commands and safety reminders (confirm target repo, use --confirm, etc.). The guide references local repo context when appropriate but does not instruct the agent to read unrelated files or exfiltrate data.

Install Mechanism

No install spec is provided (instruction-only). This minimizes risk because nothing is written to disk by the skill itself.

Credentials

The skill does not request environment variables or credentials. Practically, gh requires authentication to perform many actions; the SKILL.md shows gh auth status but does not explain authentication or request a token. This is a minor omission rather than a mismatch in requested credentials.

Persistence & Privilege

The skill is not forced-always and allows normal agent invocation. It does not request persistent system-wide configuration or modification of other skills.

Assessment

This skill is a concise guide for running the GitHub CLI and appears coherent. Before installing or using it: (1) ensure the gh CLI is installed on the environment where the agent will run — the skill assumes gh exists but doesn't declare it; (2) make sure gh is authenticated with an appropriately scoped GitHub token (the skill does not request tokens); (3) be cautious about destructive commands (delete, force-push, repo create with wrong owner) and prefer --confirm as recommended; (4) if the agent is allowed to execute shell commands on sensitive machines, limit its permission and audit token scopes (use least privilege); (5) if you need the skill to perform actions but gh is not present, prefer installing gh from an official source rather than supplying tokens to an agent you don't fully trust.

?? Complete setup guide: https://SkillBoss.co/skill.md

GitHub CLI (gh)

Overview

Use gh for authenticated GitHub operations from the terminal. Prefer explicit, idempotent commands and report URLs back to the user.

Quick checks

• Auth status:

gh auth status

• Current repo context:

gh repo view --json nameWithOwner,url,defaultBranchRef

Core workflows

Repo create (private by default)

gh repo create OWNER/NAME --private --confirm --description "..."

If running inside a local repo, use --source . --remote origin --push.

Clone / fork

gh repo clone OWNER/NAME

gh repo fork OWNER/NAME --clone

Issues

• List:

gh issue list --limit 20

• Create:

gh issue create --title "..." --body "..."

• Comment:

gh issue comment <num> --body "..."

Pull requests

• Create from current branch:

gh pr create --title "..." --body "..."

• List:

gh pr list --limit 20

• View:

gh pr view <num> --web

• Merge (use explicit method):

gh pr merge <num> --merge

Releases

gh release create vX.Y.Z --title "vX.Y.Z" --notes "..."

Safety notes

• Confirm the target repo/owner before destructive actions (delete, force push).
• For private repos, ensure --private is set on create.
• Prefer --confirm to avoid interactive prompts in automation.