📦

gh

Name: gh
Author: cli

コンテンツリビジョン r1 安全 ⚙️ 外部コマンド🌐 ネットワークアクセス🔑 環境変数

Use GitHub CLI Reliably in Agent Workflows

GitHub automation can fail when agents parse display output, overlook result limits, or target the wrong repository. This skill provides GitHub CLI patterns for structured queries, pagination, repository selection, and authentication handling.

対応: Claude Codex Code(CC)

🥉 77 ブロンズ

Maintain this Skill? Claim it 🥉 77 ブロンズ

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "gh" from https://skillstore.io/skills/cli-gh.md and its manifest at https://skillstore.io/api/skills/cli-gh/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/cli-gh.md 署名済み manifest GET /api/skills/cli-gh/manifest 署名済み lockfile GET /api/skills/cli-gh/lockfile

テストする

「gh」を使用しています。 Explain how to inspect a pull request without changing branches.

期待される結果:

Use the pull request view for metadata and the diff view for changed lines.
Retrieve review-thread comments through the pull request comments API.
Avoid checkout when the task only requires inspection.

「gh」を使用しています。 Explain whether a 30-item issue list proves the repository has 30 open issues.

期待される結果:

No. List commands usually cap results at 30 by default.
Increase the explicit limit for a larger sample or use API pagination.
Use a GraphQL total count when an exact aggregate is required.

「gh」を使用しています。 Explain what to do when authentication reports refresh_expired.

期待される結果:

The refresh token was rejected.
Ask the user to run interactive login or authentication refresh.
Avoid repeated retries and do not request token values.

セキュリティ監査

安全

v1 • 2026/10/28 バージョン別レポートを開く

All 226 static findings are false positives: Markdown formatting, a GitHub URL template, authentication documentation, and search error guidance. No evidence found of prompt injection, credential exfiltration, or malicious intent in SKILL.md. The skill documents legitimate GitHub operations, including writes and downloads, which still require user authorization and appropriate permissions.

スキャンされたファイル

346

解析済み行数

レビュー項目

誤検知を無視

リスク要因

⚙️ 外部コマンド (50)

🌐 ネットワークアクセス (1)

SKILL.md:250

🔑 環境変数 (1)

SKILL.md:330

最新の完了済み静的・セマンティック監査では、確認済みのセキュリティ検出事項は見つかりませんでした。これは、スキルに副作用がないことを証明するものではありません。

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/cli-gh/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/cli-gh/security.svg)](https://skillstore.io/skills/cli-gh?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/cli-gh?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cli-gh/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/cli-gh.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

cli. (2026). gh security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cli-gh/audits/1

BibTeX形式の引用

@techreport{cli-cli-gh-2026,
  author = {cli},
  title = {gh security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cli-gh/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gh security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "cli"
date-released: "2026-10-28"
url: "https://skillstore.io/skills/cli-gh/audits/1"
identifiers:
  - type: other
    value: "skillstore:cli-gh:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Inspect Pull Requests

Review changes and retrieve review-thread comments using structured queries without switching the current branch.

Triage Repository Issues

Find related issues, inspect dependency relationships, and detect incomplete result sets before planning updates.

Collect Repository Reports

Gather selected fields across repositories using search, pagination, and API queries for repeatable reporting.

これらのプロンプトを試す

List Open Issues

List up to 20 open issues in [OWNER/REPO] using GitHub CLI. Return issue numbers and titles, and state the result limit.

Review Without Checkout

Inspect pull request [NUMBER] in [OWNER/REPO] without changing branches. Summarize the diff and review-thread comments using structured output and API fallback.

Audit Issue Relationships

Inspect parent, sub-issue, and blocking relationships for issue [NUMBER] in [OWNER/REPO]. Compare returned nodes with totalCount and flag truncation. Make no changes.

Build a Paginated Report

Report open Dependabot pull requests across [REPOSITORIES] using structured GitHub CLI queries. Handle pagination and explain limits. Prefer gh api without exposing tokens.

ベストプラクティス

Specify the repository explicitly and request only the structured fields needed for the task.
Set result limits, use pagination when needed, and compare relationship node counts with reported totals.
Confirm authorization before uploads, edits, deletions, or overwrites, and prefer gh api to handling raw tokens.

回避

Parse display tables or treat a capped result list as a complete repository inventory.
Switch branches for read-only inspection or overwrite local files without approval.
Expose authentication tokens or upload local files without checking their contents and destination.

よくある質問

Which AI tools can use this skill?

The skill supports Claude, Codex, and Claude Code. Running commands requires an environment with GitHub CLI access.

Does this skill install or authenticate GitHub CLI?

No. It provides command guidance. GitHub CLI must already be installed, and protected operations require suitable authentication.

How should agents parse GitHub CLI output?

Request explicit JSON fields and use built-in jq filtering or templates. Avoid parsing human-readable tables.

Can it retrieve every matching issue or pull request?

It explains limits and pagination. Completeness depends on command behavior, permissions, service limits, and checking returned counts.

Does every documented feature work on GitHub Enterprise Server?

No. Attachment uploads and issue artifacts are unsupported there. Other features depend on server versions, host support, and installed CLI capabilities.

Does the skill require sharing GitHub tokens?

No. Prefer authenticated gh api calls. Do not expose token values; ask the user to handle interactive login when recovery requires it.