# Github Management

> Use when Codex needs to manage GitHub repositories with gh CLI or GitHub APIs, including issues, pull requests, review comments, GitHub Actions CI, releases, labels, milestones, branch protection, repository hygiene, security audit, dependency alerts, or repo governance tasks.

- **Type:** Skill
- **Install:** `agentstack add skill-eriemon-github-management-github-management`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Eriemon](https://agentstack.voostack.com/s/eriemon)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [Eriemon](https://github.com/Eriemon)
- **Source:** https://github.com/Eriemon/github-management

## Install

```sh
agentstack add skill-eriemon-github-management-github-management
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Github Management

Use this skill for full-cycle GitHub repository management. Prefer `gh` CLI for authenticated operations and use GitHub REST or GraphQL only when `gh` does not expose the needed data cleanly.

## Core Rule

Collect facts first, summarize risk, then ask before any mutating action.

Mutating actions include pushing commits, merging PRs, closing issues, deleting branches or tags, creating releases, changing labels or milestones, editing branch protection, changing repository settings, modifying permissions, dismissing reviews, rerunning workflows, and applying generated fixes.

Run the pipeline exactly:

`Context -> Auth -> Read-only Inspect -> Risk Summary -> Confirmation -> Mutation -> Verification`

If context, authentication, target identifiers, or user intent are missing, stop and ask. Do not guess.

## Authentication Onboarding

When this skill is triggered, first decide whether GitHub authentication is already ready for the requested repo. If readiness is unknown or missing, tell the user how to configure GitHub access step by step before doing GitHub management work.

Do not skip this onboarding. Use `references/authentication.md` and present the user-facing steps there. Keep the guidance practical:

1. Ask the user to create a classic Personal Access Token with `repo` scope.
2. Tell them to save it locally under this skill's `config/` folder, never in chat.
3. Tell them to run `gh auth login --with-token /scripts/inspect_repo_context.py" --repo "." --json` when you need one read-only snapshot of local remotes, current branch, repo slug, and auth readiness.
   - Identify the local repository path and remote with `git remote -v`.
   - Confirm the target owner/repo with `gh repo view --json nameWithOwner,url`.
   - If the task references a PR, issue, release, branch, label, or workflow, resolve its exact identifier before acting.
2. Verify authentication.
   - Read `references/authentication.md` and inspect `config/auth.example.json` for the expected local auth shape.
   - Run `gh auth status`.
   - If authentication or scope is missing, guide the user through `gh auth login --with-token /scripts/inspect_pr.py" --repo "." --json
python "/scripts/inspect_ci.py" --repo "." --json
python "/scripts/inspect_pr_checks.py" --repo "." --json
python "/scripts/inspect_repo_context.py" --repo "." --json
python "/scripts/inspect_release.py" --repo "." --json
python "/scripts/fetch_comments.py" --repo "." --json
python "/scripts/triage_issues.py" --repo "." --json
python "/scripts/repo_audit.py" --repo "." --json
```

All JSON output uses:

```json
{"ok": true, "source": "github-management", "items": [], "warnings": [], "next_actions": []}
```

## Task Guide

| Task | First inspection | Confirmation needed before |
| --- | --- | --- |
| Issue triage | `triage_issues.py` or `gh issue list --json ...` | labeling, assigning, closing, editing milestone |
| Repo context | `inspect_repo_context.py` | switching target repo assumptions, pushing, merging, release edits |
| PR review | `inspect_pr.py` | pushing fixes, submitting reviews, merging |
| Review comments | `fetch_comments.py`; read `references/review-comments.md` | resolving conversations or pushing fixes |
| CI failure | `inspect_ci.py` or `inspect_pr_checks.py`; read `references/ci-diagnostics.md` | rerunning workflows or applying fixes |
| Release | `inspect_release.py` or `gh release list/view` | creating, editing, deleting, or publishing a release |
| Repo audit | `repo_audit.py` | changing settings, protections, permissions, secrets, Actions policy |
| Security review | Read the matching security best-practice reference listed below | filing issues, changing policy, applying fixes |
| Threat model | Read `references/security-threat-model-template.md` and `references/security-controls-and-assets.md` | writing files, filing issues, applying mitigations |
| Security ownership map | Run `scripts/security_ownership/run_ownership_map.py` and query with `scripts/security_ownership/query_ownership.py` | writing analysis outside the requested output directory |

## Security Reference Routing

For security best practices, identify the repo language and framework, then load every matching reference:

- Go backend: `references/security-best-practices-golang-general-backend-security.md`
- JavaScript Express backend: `references/security-best-practices-javascript-express-web-server-security.md`
- JavaScript frontend, no framework or unclear framework: `references/security-best-practices-javascript-general-web-frontend-security.md`
- jQuery frontend: `references/security-best-practices-javascript-jquery-web-frontend-security.md`
- TypeScript/Next.js backend or full-stack app: `references/security-best-practices-javascript-typescript-nextjs-web-server-security.md`
- TypeScript/React frontend: `references/security-best-practices-javascript-typescript-react-web-frontend-security.md`
- TypeScript/Vue frontend: `references/security-best-practices-javascript-typescript-vue-web-frontend-security.md`
- Python Django backend: `references/security-best-practices-python-django-web-server-security.md`
- Python FastAPI backend: `references/security-best-practices-python-fastapi-web-server-security.md`
- Python Flask backend: `references/security-best-practices-python-flask-web-server-security.md`

For threat modeling, stay repo-grounded: use evidence anchors, trust boundaries, assets, attacker capabilities, abuse paths, mitigations, and explicit assumptions from `references/security-threat-model-template.md`.

For security ownership map tasks, keep analysis read-only against git history. Write artifacts only to the user-specified output directory or a repo-local `ownership-map-out/`, then use `references/security-ownership-neo4j-import.md` only when graph import is requested.

## References

- Read `references/authentication.md` before configuring or troubleshooting GitHub authentication.
- Read `references/safety-policy.md` before any mutating GitHub action.
- Read `references/workflows.md` for task-specific GitHub workflows.
- Read `references/review-comments.md` for PR comment and review-thread handling.
- Read `references/ci-diagnostics.md` for failing check and log inspection.
- Read `references/development-practices.md` before code changes caused by GitHub management work.
- Read `references/release-installation.md` for this skill's local release branch, floating install tag, and Codex install path.
- Read `references/source-attribution.md` when source provenance matters.

## Common Mistakes

- Do not infer authentication from local git access; always check `gh auth status`.
- Do not treat external CI as GitHub Actions; report the URL and ask for access or logs.
- Do not merge or close anything because tests pass; summarize and ask first.
- Do not modify repository settings from an audit command. Audits are read-only.
- Do not assume `release` is a safe short ref if a tag named `release` exists; use `github-management-release` for the floating install tag and report ambiguity explicitly.
- Do not hide uncertainty. If GitHub returns partial data or permissions block a check, report the gap.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Eriemon](https://github.com/Eriemon)
- **Source:** [Eriemon/github-management](https://github.com/Eriemon/github-management)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-eriemon-github-management-github-management
- Seller: https://agentstack.voostack.com/s/eriemon
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.