GitHub CLI

GitHub operations via `gh` CLI: issues, PRs, CI runs, code review, API queries. Use when: (1) checking PR status or CI, (2) creating/commenting on issues, (3...

Security Scan

The skill's requirements and instructions align with its stated purpose (using the GitHub CLI); nothing requested appears disproportionate or unrelated.

Purpose & Capability

Name and description match the declared dependency on the gh CLI and the provided commands. The skill is instruction-only and all commands in SKILL.md are consistent with normal GitHub CLI usage (issues, PRs, runs, api queries).

Instruction Scope

Instructions tell the agent to run gh commands and to run gh auth login/status; they do not instruct reading unrelated system files or exporting data to third-party endpoints. Note: when the agent runs gh it will use whatever GitHub auth/config exists on the host (e.g., gh's config files and stored tokens), which is expected behavior for a CLI-based GitHub integration.

Install Mechanism

Install targets are standard package managers (brew and apt) which is low-risk. Minor inconsistency: registry-level install spec listed only a brew formula, whereas the SKILL.md metadata includes both brew and apt entries. No arbitrary downloads or archive extraction are present.

Credentials

The skill declares no required environment variables or credentials, which fits its use of the gh CLI. However, using the gh CLI implicitly involves GitHub credentials managed by gh (local config/tokens); the skill does not request unrelated secrets or service keys.

Persistence & Privilege

always is false and the skill is user-invocable; autonomous invocation is allowed (platform default) and appropriate for this kind of CLI skill. The skill does not request elevated persistence or modify other skills or system-wide settings.

Scan Findings in Context

[no_code_files_to_scan] expected: The regex scanner had no code files to analyze because this is an instruction-only skill (SKILL.md). That is expected for a CLI usage guide.

Assessment

This skill is coherent and appears to do what it says: run gh commands for GitHub tasks. Before installing: ensure you trust the skill source (it is instruction-only and comes from an unknown homepage), install gh from a trusted package source (brew/apt), and verify your gh authentication (run gh auth status). Be aware that if the agent is allowed to invoke the skill autonomously it can run gh commands using whatever GitHub credentials/tokens are configured on your machine; review token scopes and revoke or re-authenticate if you have concerns. Also note the small metadata mismatch (brew vs brew+apt) and confirm your preferred install path.

GitHub Skill

Use the gh CLI to interact with GitHub repositories, issues, PRs, and CI.

When to Use

✅ USE this skill when:

• Checking PR status, reviews, or merge readiness
• Viewing CI/workflow run status and logs
• Creating, closing, or commenting on issues
• Creating or merging pull requests
• Querying GitHub API for repository data
• Listing repos, releases, or collaborators

When NOT to Use

❌ DON'T use this skill when:

• Local git operations (commit, push, pull, branch) → use git directly
• Non-GitHub repos (GitLab, Bitbucket, self-hosted) → different CLIs
• Cloning repositories → use git clone
• Reviewing actual code changes → use coding-agent skill
• Complex multi-file diffs → use coding-agent or read files directly

Setup

# Authenticate (one-time)
gh auth login

# Verify
gh auth status

Common Commands

Pull Requests

# List PRs
gh pr list --repo owner/repo

# Check CI status
gh pr checks 55 --repo owner/repo

# View PR details
gh pr view 55 --repo owner/repo

# Create PR
gh pr create --title "feat: add feature" --body "Description"

# Merge PR
gh pr merge 55 --squash --repo owner/repo

Issues

# List issues
gh issue list --repo owner/repo --state open

# Create issue
gh issue create --title "Bug: something broken" --body "Details..."

# Close issue
gh issue close 42 --repo owner/repo

CI/Workflow Runs

# List recent runs
gh run list --repo owner/repo --limit 10

# View specific run
gh run view <run-id> --repo owner/repo

# View failed step logs only
gh run view <run-id> --repo owner/repo --log-failed

# Re-run failed jobs
gh run rerun <run-id> --failed --repo owner/repo

API Queries

# Get PR with specific fields
gh api repos/owner/repo/pulls/55 --jq '.title, .state, .user.login'

# List all labels
gh api repos/owner/repo/labels --jq '.[].name'

# Get repo stats
gh api repos/owner/repo --jq '{stars: .stargazers_count, forks: .forks_count}'

JSON Output

Most commands support --json for structured output with --jq filtering:

gh issue list --repo owner/repo --json number,title --jq '.[] | "\(.number): \(.title)"'
gh pr list --json number,title,state,mergeable --jq '.[] | select(.mergeable == "MERGEABLE")'

Templates

PR Review Summary

# Get PR overview for review
PR=55 REPO=owner/repo
echo "## PR #$PR Summary"
gh pr view $PR --repo $REPO --json title,body,author,additions,deletions,changedFiles \
  --jq '"**\(.title)** by @\(.author.login)\n\n\(.body)\n\n📊 +\(.additions) -\(.deletions) across \(.changedFiles) files"'
gh pr checks $PR --repo $REPO

Issue Triage

# Quick issue triage view
gh issue list --repo owner/repo --state open --json number,title,labels,createdAt \
  --jq '.[] | "[\(.number)] \(.title) - \([.labels[].name] | join(", ")) (\(.createdAt[:10]))"'

Notes

• Always specify --repo owner/repo when not in a git directory
• Use URLs directly: gh pr view https://github.com/owner/repo/pull/55
• Rate limits apply; use gh api --cache 1h for repeated queries