Skip to content
cccskills
FreePublished on GitHub

gh-cli

Guides agents to access GitHub repositories, pull requests, issues, and APIs through the authenticated gh command-line tool. Covers private repository access and recommends cloning repositories to read files locally, with commands for viewing GitHub information.

OriginalShow the original description

Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.

Works withGitHub
See how to install

Good for

  • Viewing GitHub pull requests and issues
  • Accessing private repositories with authentication
  • Querying the GitHub API through gh
  • Cloning a repository to inspect its files

Files included (3)

  • SKILL.md1.2 KB
  • agents/openai.yaml219 B
  • assets/trail-of-bits-mark.svg3.0 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

gh-cli

When to Use

  • Working with GitHub repositories, pull requests, issues, releases, or raw file URLs.
  • You need authenticated access to private repositories or higher API rate limits.
  • You are about to use curl, wget, WebFetch, or an MCP fetch tool against GitHub.

When NOT to Use

  • The target is not GitHub.
  • Plain local git operations already solve the task.

Guidance

Prefer the authenticated gh CLI over raw HTTP fetches for GitHub content. In particular:

  • Prefer gh repo view, gh pr view, gh pr list, gh issue view, and gh api over unauthenticated curl or wget.
  • Prefer cloning a repository and reading files locally over fetching raw.githubusercontent.com blobs directly.
  • Avoid using GitHub API /contents/ endpoints as a substitute for cloning and reading repository files.

Examples:

gh repo view owner/repo
gh pr view 123 --repo owner/repo
gh api repos/owner/repo/pulls

For the hook implementation, see:

  • plugins/gh-cli/README.md
  • plugins/gh-cli/hooks/

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Build and test code with AddressSanitizer, a tool that detects invalid memory access during execution. Configure checks for C/C++ and unsafe Rust, investigate crash reports, and adjust settings for fuzzing, or testing with generated inputs.

  • Detect memory errors while fuzzing C/C++
  • Test unsafe Rust and calls to external libraries
  • Interpret an ASan crash report
trailofbits/skills7.6KUpdated Oct 16, 2026

aflpp

FreeSummary

Sets up AFL++ to test C/C++ programs with varied generated inputs, a technique called fuzzing. Covers running tests across CPU cores, monitoring progress, reducing input collections, and reproducing crashes for investigation.

  • Running C/C++ fuzzing across multiple CPU cores
  • Exploring further after libFuzzer progress stalls
  • Monitoring fuzzing progress and stability
trailofbits/skills7.6KUpdated Oct 16, 2026

Audits GitHub Actions workflows that run AI coding agents. Traces how attacker-controlled content reaches prompts, checks permissions and sandbox settings, and reports evidence, severity, and fixes for prompt injection and related configuration risks.

  • Reviewing workflows that run AI coding agents
  • Tracing issue and PR content into agent prompts
  • Checking sandbox settings and user allowlists
trailofbits/skills7.6KUpdated Oct 16, 2026

Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.

  • Security checks before an Algorand contract audit
  • Reviewing TEAL or PyTeal transaction validation
  • Verifying fixes for reported vulnerabilities
trailofbits/skills7.6KUpdated Oct 16, 2026

atheris

FreeSummary

Set up Atheris to test Python code and C extensions with automatically varied inputs. It guides test harness creation, coverage tracking to explore more code, and AddressSanitizer setup for finding memory errors.

  • Fuzzing a Python package or parser
  • Investigating memory corruption in Python C extensions
  • Turning raw bytes into typed test arguments
trailofbits/skills7.6KUpdated Oct 16, 2026

Connect static analysis results and human audit notes to a Trailmark code graph. Group findings by severity and compare them with input flow, impact, and privilege boundaries to prioritize investigation and understand findings in their code context.

  • Connecting Semgrep or CodeQL results to code structure
  • Combining human audit notes with automated findings
  • Prioritizing findings using input flow and impact
trailofbits/skills7.6KUpdated Oct 16, 2026

See all skills by trailofbits

Report a problem with this skill