Skip to content
alyn
trailofbits

Gh CLI skill

Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.

$npx skills add trailofbits/skills --skill gh-cli
View this skill on GitHubtrailofbits/skills/plugins/gh-cli/skills/gh-cli/SKILL.md
Pack stars
8,113
Pack installs
463k
Alyn Score
71/99
Updated
4 days ago
License
CC-BY-SA-4.0
– views – installs via Alyn

trailofbits

Gh CLI

Security Automation

Install Gh CLI

Pick your agent. Every command is ready to paste.

$npx skills add trailofbits/skills --skill gh-cli

The open skills CLI detects your agents (Claude Code, Cursor, Codex and 70+ more) and installs to the right folder. Add -g to install globally.

01

Install it

Run the command above, or upload the folder in Claude.

02

Ask naturally

Describe the task. Your agent loads gh-cli when the request matches its description.

03

Name it if needed

If it does not trigger, say “use the gh-cli skill”. In Codex, type $gh-cli.

The skill itself

SKILL.md

FolderGitHub

gh-cli

When to Use

  • Working with GitHub repositories, pull requests, issues, releases, or raw file URLs.
  • You need authenticated access to private repositories or higher API rate limits.
  • You are about to use curl, wget, WebFetch, or an MCP fetch tool against GitHub.

When NOT to Use

  • The target is not GitHub.
  • Plain local git operations already solve the task.

Guidance

Prefer the authenticated gh CLI over raw HTTP fetches for GitHub content. In particular:

  • Prefer gh repo view, gh pr view, gh pr list, gh issue view, and gh api over unauthenticated curl or wget.
  • Prefer cloning a repository and reading files locally over fetching raw.githubusercontent.com blobs directly.
  • Avoid using GitHub API /contents/ endpoints as a substitute for cloning and reading repository files.

Examples:

gh repo view owner/repo
gh pr view 123 --repo owner/repo
gh api repos/owner/repo/pulls

For the hook implementation, see:

  • plugins/gh-cli/README.md
  • plugins/gh-cli/hooks/

Tips for Gh CLI

  • • Start a fresh session after installing so your agent picks up the new skill.
  • • It bundles reference files. The agent reads them only when needed, so they cost no context until then.
  • • It is part of a pack with 30 skills. Install only the ones you need with --skill to keep triggers precise.
  • • If two skills overlap, mention the one you want by name.

Questions about Gh CLI

What does the Gh CLI skill do?

Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.

How do I install Gh CLI?

Run "npx skills add trailofbits/skills --skill gh-cli" in your project. The skills CLI installs it for Claude Code, Cursor, Codex and 70+ other agents. In Claude on the web, upload the skill folder as a ZIP under Customize > Skills.

Does Gh CLI work in Cursor and Codex?

Yes. Gh CLI uses the open SKILL.md format, so it works in Claude Code, Claude, Cursor, OpenAI Codex, Gemini CLI, GitHub Copilot and other agents that support agent skills.

Is Gh CLI free?

Gh CLI is open source on GitHub under the CC-BY-SA-4.0 license. It is free to install; check the license before commercial use.

Who made Gh CLI?

Gh CLI is published by trailofbits in the trailofbits/skills repository, together with 29 other skills.

Similar skills. From other creators.