gh-cli skill
✓ VerifiedEnforces authenticated GitHub CLI workflows for managing repositories, pull requests, issues, and API access.
- GitHub stars
- 8,136
- Files
- 3
- Last commit
- Nov 11, 2026
- License
- CC-BY-SA-4.0
- Allowed tools
- —
What does the gh-cli skill do?
gh-cli enforces authenticated GitHub CLI workflows for managing repositories, pull requests, issues, and API access.
Summary generated from the skill's SKILL.md.
About the gh-cli skill
Managing GitHub repositories, pull requests, and issues through authenticated workflows is the primary function of this skill. Developers should load it whenever an agent needs to interact with GitHub URLs, access private repositories, or require higher API rate limits than unauthenticated methods allow. It provides a structured way to handle GitHub content by prioritizing the gh CLI over standard web fetching tools.
Instead of using curl, wget, or WebFetch to grab data, the agent uses specific commands like gh repo view, gh pr view, gh pr list, gh issue view, and gh api. It also encourages cloning repositories to read files locally rather than fetching raw blobs from raw.githubusercontent.com or using the GitHub API contents endpoints. This approach ensures that all interactions remain authenticated and efficient for complex repository management tasks.
What an agent can do with it
- 1Accessing private repository dataAn agent can retrieve information from private repositories that require authentication to view.
- 2Replacing unauthenticated web fetchesUse this skill to avoid using standard fetch tools when interacting with GitHub content.
Written from the skill's SKILL.md. Every use case is checked against a quote from it.
How to install the gh-cli skill
Each command copies the skill folder into the client's skills directory. Restart the client or start a new session to load it.Install the gh-cli skill in Plugin
/plugin marketplace add trailofbits/skills /plugin install gh-cli@trailofbits
Install the gh-cli skill in Claude Code
~/.claude/skills/gh-cli/SKILL.md
$ npx degit trailofbits/skills/plugins/gh-cli/skills/gh-cli ~/.claude/skills/gh-cliInstall the gh-cli skill in Claude Code (project)
.claude/skills/gh-cli/SKILL.md
$ npx degit trailofbits/skills/plugins/gh-cli/skills/gh-cli .claude/skills/gh-cliInstall the gh-cli skill in Codex
~/.agents/skills/gh-cli/SKILL.md
$ npx degit trailofbits/skills/plugins/gh-cli/skills/gh-cli ~/.agents/skills/gh-cliInstall the gh-cli skill in Gemini CLI
~/.gemini/skills/gh-cli/SKILL.md
$ npx degit trailofbits/skills/plugins/gh-cli/skills/gh-cli ~/.gemini/skills/gh-cliInstall the gh-cli skill in Claude.ai
npx degit trailofbits/skills/plugins/gh-cli/skills/gh-cli gh-cli && zip -r gh-cli.zip gh-cli # claude.ai → Customize → Skills → + → Create skill → Upload a skill → gh-cli.zip
Automated checks
Ran Nov 14, 2026Full report →Passed our automated checks. That is not a security audit: read the scripts before you let an agent run them. How checks work
- Source repository linked and reachabletrailofbits/skills/plugins/gh-cli/skills/gh-cli is public and reachablegithub.com/trailofbits/skills/tree/HEAD/plugins/gh-cli/skill ↗Pass
- Open source license (OSI)CC-BY-SA-4.0 is not OSI-approvedspdx.org/licenses/CC-BY-SA-4.0.html ↗Finding
- Commit or release in the last yearLast commit 2026-11-11github.com/trailofbits/skills/commits ↗Pass
- No download-and-run or credential theft in scriptsNo scripts in the skill folderPass
- No hidden instructions in SKILL.mdNo override phrases, safeguard switches, credential requests or hidden charactersgithub.com/trailofbits/skills/blob/HEAD/plugins/gh-cli/skill ↗Pass
- Pre-approved tools are scopedNo pre-approved tools; the agent asks before using onegithub.com/trailofbits/skills/blob/HEAD/plugins/gh-cli/skill ↗Pass
SKILL.md
View on GitHubgh-cli
When to Use
- Working with GitHub repositories, pull requests, issues, releases, or raw file URLs.
- You need authenticated access to private repositories or higher API rate limits.
- You are about to use
curl,wget,WebFetch, or an MCP fetch tool against GitHub.
When NOT to Use
- The target is not GitHub.
- Plain local git operations already solve the task.
Guidance
Prefer the authenticated gh CLI over raw HTTP fetches for GitHub content. In particular:
- Prefer
gh repo view,gh pr view,gh pr list,gh issue view, andgh apiover unauthenticatedcurlorwget. - Prefer cloning a repository and reading files locally over fetching
raw.githubusercontent.comblobs directly. - Avoid using GitHub API
/contents/endpoints as a substitute for cloning and reading repository files.
Examples:
gh repo view owner/repo
gh pr view 123 --repo owner/repo
gh api repos/owner/repo/pulls
For the hook implementation, see:
plugins/gh-cli/README.mdplugins/gh-cli/hooks/
Files in this skill
3gh-cli skill questions
How do I install the gh-cli skill in Claude Code?
Run npx degit trailofbits/skills/plugins/gh-cli/skills/gh-cli ~/.claude/skills/gh-cli. Claude Code loads skills from ~/.claude/skills (all projects) or .claude/skills (one project) and uses a skill when its description matches the task.
Which clients can use the gh-cli skill?
Any client that reads the Agent Skills format: Claude Code, Codex, Gemini CLI and claude.ai (upload as a ZIP). Scripts in the skill run only where the client allows code execution.
When should I use the gh-cli skill?
Use this skill when working with GitHub repositories, pull requests, issues, releases, or raw file URLs, especially when authenticated access to private repositories is required.
Should I use curl or gh CLI for GitHub content?
You should prefer the authenticated gh CLI over raw HTTP fetches like curl or wget for GitHub content.
When is it not appropriate to use this skill?
Do not use this skill if the target is not GitHub or if plain local git operations are sufficient to complete the task.