Gh CLI — Agent Skill by Trail of Bits

From the author

Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.

— the description by Trail of Bits

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides guidance on prioritizing the gh CLI for interacting with GitHub resources. It mandates the use of authenticated workflows for repository, pull request, and issue management to ensure secure and rate-limited access, discouraging the use of generic web fetching tools for GitHub-specific tasks.

What it does

Promotes the use of gh repo view, gh pr view, and gh pr list for repository and pull request data.
Recommends using gh issue view for accessing issue details.
Encourages the use of gh api for direct GitHub API interactions.
Advocates for cloning repositories to read files locally rather than fetching raw blobs.
Directs users away from using GitHub API contents endpoints for file retrieval.

When to use it

When interacting with GitHub repositories, pull requests, issues, or releases.
When authenticated access is required for private repositories.
When you need to avoid hitting API rate limits associated with unauthenticated requests.
When you are considering using generic fetch tools to retrieve GitHub content.

Advantages

Ensures authenticated access to GitHub resources.
Provides higher API rate limits compared to unauthenticated requests.
Standardizes interactions with GitHub through a dedicated CLI tool.
Reduces reliance on insecure or inefficient web fetching patterns for repository data.

Usage examples

“View the details of a specific GitHub repository.”: The agent executes gh repo view owner/repo to retrieve repository information.
“Get information about pull request number 123.”: The agent executes gh pr view 123 --repo owner/repo to display the pull request details.
“Fetch data from the GitHub API for a specific repository.”: The agent executes gh api repos/owner/repo/pulls to retrieve the requested API data.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/trailofbits/gh-cli/download
Unzip it into the cross-client skills folder of your project:
```
mkdir -p .agents/skills && unzip gh-cli.zip -d .agents/skills
```

Documentation by Trail of Bits

gh-cli

When to Use

Working with GitHub repositories, pull requests, issues, releases, or raw file URLs.
You need authenticated access to private repositories or higher API rate limits.
You are about to use curl, wget, WebFetch, or an MCP fetch tool against GitHub.

When NOT to Use

The target is not GitHub.
Plain local git operations already solve the task.

Guidance

Prefer the authenticated gh CLI over raw HTTP fetches for GitHub content. In particular:

Prefer gh repo view, gh pr view, gh pr list, gh issue view, and gh api over unauthenticated curl or wget.
Prefer cloning a repository and reading files locally over fetching raw.githubusercontent.com blobs directly.
Avoid using GitHub API /contents/ endpoints as a substitute for cloning and reading repository files.

Examples:

gh repo view owner/repo
gh pr view 123 --repo owner/repo
gh api repos/owner/repo/pulls

For the hook implementation, see:

plugins/gh-cli/README.md
plugins/gh-cli/hooks/

Files

ATTRIBUTION.mdAdded by AutoGineer912 B
LICENSELicence file added by AutoGineer19.7 KiB
SKILL.md1.2 KiB
agents/openai.yaml219 B
assets/trail-of-bits-mark.svg3.0 KiB

Requirements and compatibility

Written for: Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Names Claude Code tools, Needs a command-line tool

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Git Guardrails Claude Code
Matt Pocock· Community
Implement safety guardrails for Claude Code to prevent accidental execution of destructive Git commands.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskHas scriptsGitHub stars of the source repository317.5k
Setup Pre Commit
Matt Pocock· Community
Automates the configuration of Husky pre-commit hooks, lint-staged, and Prettier for your project.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository317.5k
CI CD And Automation
Addy Osmani· Community
A comprehensive framework for establishing automated CI/CD pipelines, quality gates, and deployment strategies.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository113.9k
Git Workflow And Versioning
Addy Osmani· Community
A comprehensive framework for disciplined Git workflows, atomic commits, and semantic versioning to ensure manageable and reliable code history.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository113.9k
Git Advanced Workflows
Seth Hobson· Community
Master advanced Git techniques for history management, bug isolation, and recovery.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository42.3k
Github Actions Templates
Seth Hobson· Community
A collection of production-ready GitHub Actions workflow templates for CI/CD automation.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k