gh

Use the GitHub CLI (gh) to perform core GitHub operations: auth status, repo create/clone/fork, issues, pull requests, releases, and basic repo management. Trigger for requests to use gh, manage GitHub repos, PRs, or issues from the CLI.

Security Scan

The skill's instructions and requirements are coherent with a GitHub-CLI helper; it only contains gh command examples and no unexpected installs or credential requests, though it omits declaring the gh binary dependency explicitly.

Purpose & Capability

The skill's name/description (GitHub CLI helper) matches the instructions (gh commands for repos, issues, PRs). Minor inconsistency: SKILL.md assumes the gh CLI is available and used, but the metadata lists no required binary. A user installing this should ensure gh is present.

Instruction Scope

Instructions are focused on running gh commands (auth status, repo create/clone/fork, issues, PRs, releases). They do not instruct reading unrelated files, exfiltrating data, or contacting endpoints other than GitHub via gh. They do include operating on the local repo (e.g., --source . --push), which is expected for this tool.

Install Mechanism

This is an instruction-only skill with no install spec and no code files: nothing is written to disk by the skill itself. Low install risk.

Credentials

The skill declares no environment variables or credentials, which is reasonable because gh manages auth. However, in practice gh operations require authenticated credentials (gh auth or GH_TOKEN) stored outside the skill. The absence of declared env vars is not dangerous but is a metadata omission worth noting.

Persistence & Privilege

The skill is not always-enabled and does not request elevated persistence or modify other skills. It can be invoked autonomously (platform default), which is normal for skills of this type.

Assessment

This skill is an instruction-only helper that tells the agent to run gh (GitHub CLI) commands. Before installing: ensure you have gh installed and configured with the credentials you intend the agent to use; be aware the agent may run commands that modify local repos or GitHub state (create/fork/merge/delete), so only allow this skill for agents you trust. If you want to restrict risk, require explicit user confirmation for any destructive actions or disable autonomous invocation for this skill. The metadata omission (no required-binary entry for gh) is benign but you should verify gh is available in the runtime environment.

GitHub CLI (gh)

Overview

Use gh for authenticated GitHub operations from the terminal. Prefer explicit, idempotent commands and report URLs back to the user.

Quick checks

• Auth status:

gh auth status

• Current repo context:

gh repo view --json nameWithOwner,url,defaultBranchRef

Core workflows

Repo create (private by default)

gh repo create OWNER/NAME --private --confirm --description "..."

If running inside a local repo, use --source . --remote origin --push.

Clone / fork

gh repo clone OWNER/NAME

gh repo fork OWNER/NAME --clone

Issues

• List:

gh issue list --limit 20

• Create:

gh issue create --title "..." --body "..."

• Comment:

gh issue comment <num> --body "..."

Pull requests

• Create from current branch:

gh pr create --title "..." --body "..."

• List:

gh pr list --limit 20

• View:

gh pr view <num> --web

• Merge (use explicit method):

gh pr merge <num> --merge

Releases

gh release create vX.Y.Z --title "vX.Y.Z" --notes "..."

Safety notes

• Confirm the target repo/owner before destructive actions (delete, force push).
• For private repos, ensure --private is set on create.
• Prefer --confirm to avoid interactive prompts in automation.