Github Xiaoshu

Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.

Security Scan

This is an instruction-only GitHub CLI helper that is internally consistent with its stated purpose, with only minor metadata and declaration oversights.

Purpose & Capability

The skill's description and SKILL.md consistently show usage of the 'gh' CLI for PRs, runs, issues, and gh api queries. However, the skill metadata lists no required binaries while the instructions assume the 'gh' CLI is available — a minor mismatch but not a substantive security concern.

Instruction Scope

SKILL.md only instructs running 'gh' commands against GitHub repos and using --repo or URLs; it does not direct reading unrelated files, accessing other environment variables, or exfiltrating data to external endpoints. Examples shown are primarily read/query commands.

Install Mechanism

There is no install specification (instruction-only), so nothing is written to disk by the skill itself. This is the lowest-risk installation model. It implicitly relies on the environment already having the 'gh' CLI installed.

Credentials

The skill declares no required environment variables or credentials. In practice, the 'gh' CLI requires authentication (e.g., gh auth login or GH_TOKEN in the environment) to perform authenticated operations; the skill correctly does not request secrets itself but will depend on whatever GitHub credentials the user has configured for 'gh'.

Persistence & Privilege

The skill is not always-enabled, is user-invocable, and does not request persistent system privileges or modify other skills' configs. Autonomous invocation is allowed (platform default) but the skill doesn't request additional persistent presence.

Assessment

This skill is an instruction-only helper for the GitHub 'gh' CLI. Before installing, ensure: 1) you have the 'gh' CLI installed on any agent runner where it will be used (the SKILL.md assumes it but the metadata doesn't declare it); 2) your 'gh' is authenticated (it will use your existing gh auth or environment GH_TOKEN), so be aware the agent will run commands with whatever repo permissions your configured credentials grant; 3) the SKILL.md examples are mostly read-only, but 'gh' can modify issues/PRs if the agent executes write commands — only enable or grant access if you trust the agent to run those operations. Also note a minor metadata mismatch (the included _meta.json owner differs from the package owner id), which is likely benign but worth verifying the skill source if provenance matters.

GitHub Skill

Use the gh CLI to interact with GitHub. Always specify --repo owner/repo when not in a git directory, or use URLs directly.

Pull Requests

Check CI status on a PR:

gh pr checks 55 --repo owner/repo

List recent workflow runs:

gh run list --repo owner/repo --limit 10

View a run and see which steps failed:

gh run view <run-id> --repo owner/repo

View logs for failed steps only:

gh run view <run-id> --repo owner/repo --log-failed

API for Advanced Queries

The gh api command is useful for accessing data not available through other subcommands.

Get PR with specific fields:

gh api repos/owner/repo/pulls/55 --jq '.title, .state, .user.login'

JSON Output

Most commands support --json for structured output. You can use --jq to filter:

gh issue list --repo owner/repo --json number,title --jq '.[] | "\(.number): \(.title)"'