📦

github

Name: github
Author: Dicklesworthstone

Content revision r1 Medium Risk ⚙️ External commands📁 Filesystem access

Manage GitHub from the Command Line

GitHub work often spans issues, pull requests, releases, Actions, and repository settings. This skill gives Claude, Codex, and Claude Code practical gh CLI commands for common GitHub workflows.

Supports: Claude Codex Code(CC)

📊 71 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "github" from https://skillstore.io/skills/dicklesworthstone-github.md and its manifest at https://skillstore.io/api/skills/dicklesworthstone-github/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dicklesworthstone-github.md Signed manifest GET /api/skills/dicklesworthstone-github/manifest Signed lockfile GET /api/skills/dicklesworthstone-github/lockfile

Test it

Using "github". How do I see open pull requests and their checks?

Expected outcome:

Run the pull request list command to find open PRs.
Then run the checks command for the PR number you want to inspect.

Using "github". How do I create a release from an existing tag?

Expected outcome:

Use the release creation command with the tag name and generated notes option, then upload any required assets.

Using "github". How do I add a GitHub Actions secret?

Expected outcome:

Use the secret set command and enter the secret value securely when prompted. Confirm the target repository before saving it.

Security Audit

Medium Risk

v9 • 7/9/2026 Open versioned report

Static Ruby backtick findings are false positives caused by markdown code formatting and fenced bash examples. The SSH key finding is also a false positive because the cited file is a public key. The remaining concern is that several documented gh commands can modify shared GitHub state without explicit safety guidance.

Files scanned

466

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:133-145 SKILL.md:204-208 SKILL.md:237-240 SKILL.md:378-381

Shared GitHub State Changes Without Safety Guidance

The skill includes examples for approving and merging pull requests, disabling workflows, deleting releases, and deleting secrets. These commands can affect shared repositories, but the guidance does not tell users to confirm authorization, repository target, or impact before running them.

The commands are real GitHub CLI operations that can modify shared project state. The issue is contextual safety guidance, not malicious code execution.

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (2)

SKILL.md:346 SKILL.md:346

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dicklesworthstone-github/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dicklesworthstone-github/security.svg)](https://skillstore.io/skills/dicklesworthstone-github?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dicklesworthstone-github?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dicklesworthstone-github/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dicklesworthstone-github.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Dicklesworthstone. (2026). github security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dicklesworthstone-github/audits/9

BibTeX citation

@techreport{dicklesworthstone-dicklesworthstone-github-2026,
  author = {Dicklesworthstone},
  title = {github security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/dicklesworthstone-github/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "Dicklesworthstone"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/dicklesworthstone-github/audits/9"
identifiers:
  - type: other
    value: "skillstore:dicklesworthstone-github:audit:9"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

Dicklesworthstone Recommended Current

dicklesworthstone-github

Skillstore Score 71

Evidence Confidence High

Skillstore usage 7

Updated

2026-08-21

ETeissonniere

eteissonniere-github

Skillstore Score 70

Evidence Confidence High

Skillstore usage 8

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Triage repository work

List issues, view pull requests, inspect checks, and search project activity from a terminal.

Automate release tasks

Create releases, generate notes, upload assets, and inspect release history with GitHub CLI commands.

Manage CI workflows

View GitHub Actions runs, read logs, rerun failed jobs, and trigger workflows with inputs.

Try These Prompts

Check my GitHub login

Use the GitHub CLI skill to show me how to check whether gh is authenticated.

Create a pull request

Use the GitHub CLI skill to create a pull request from my current branch and include a concise title and body.

Investigate failed CI

Use the GitHub CLI skill to list recent workflow runs, view a failed run, and show the log command.

Prepare a release workflow

Use the GitHub CLI skill to outline a safe release process with commands for creating a release, generating notes, and uploading assets.

Best Practices

Confirm the active repository and branch before running state-changing commands.
Use read-only commands first to inspect issues, pull requests, releases, and workflow runs.
Follow team approval rules before merging pull requests, disabling workflows, or deleting resources.

Avoid

Do not run merge, delete, or workflow disable commands without confirming authorization.
Do not upload private SSH keys or secret files to GitHub.
Do not create public repositories or public gists with confidential information.

Frequently Asked Questions

Does this skill install GitHub CLI?

No. It assumes gh is already installed and available in the terminal.

Can it authenticate to GitHub for me?

It shows authentication commands, but the user must complete any login or token approval steps.

Does it support pull request reviews?

Yes. It includes commands to approve, request changes, comment, checkout, and merge pull requests.

Can these commands change production repositories?

Yes. Some commands can merge code, delete resources, disable workflows, or change secrets. Review them before running.

Does it handle GitHub Actions?

Yes. It covers listing runs, viewing logs, watching runs, rerunning failed jobs, and manually running workflows.

Is it safe to add SSH keys with this skill?

Only upload public key files with a .pub suffix. Never upload private SSH key files.

Developer Details

Author

Dicklesworthstone

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/Dicklesworthstone/agent_flywheel_clawdbot_skills_and_integrations/tree/main/skills/github

Ref

1ffa7643651792ccb4bd3b15d924d2c97edff755

Maintenance freshness

7/18/2026

Usage

5 downloads · 353 views

File structure

📄 SKILL.md