# Gh

> GitHub CLI (gh) and GitHub Actions workflows with git hygiene: secure CI YAML, least-privilege tokens, caching, concurrency, script-injection prevention, PR and issue automation, and operational commands. Use when authoring or reviewing .github/workflows, debugging Actions runs, using gh for repos/issues/PRs/runs/secrets/api, or when the user mentions GitHub Actions, GHA, workflow YAML, gh CLI, G…

- **Type:** Skill
- **Install:** `agentstack add skill-kaynetik-skills-gh`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [kaynetik](https://agentstack.voostack.com/s/kaynetik)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [kaynetik](https://github.com/kaynetik)
- **Source:** https://github.com/kaynetik/skills/tree/main/gh

## Install

```sh
agentstack add skill-kaynetik-skills-gh
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Git, GitHub CLI, and GitHub Actions

## Reference files

| Topic | File | When to read |
| :--- | :--- | :--- |
| GitHub Actions (workflows, security, performance) | [reference/github-actions.md](reference/github-actions.md) | Writing or reviewing workflow YAML, CI design, hardening |
| GitHub CLI (`gh`) | [reference/gh-cli.md](reference/gh-cli.md) | Commands for repos, issues, PRs, runs, secrets, API |

Read the relevant reference before suggesting version-specific action tags or `gh` flags; prefer verifying against current docs or `gh --help`.

## Git (repository hygiene)

- **Commits:** Small, coherent changes; messages that state intent and context (what changed and why, not only how).
- **Branches:** Use a consistent team convention for naming; keep feature branches short-lived and rebased or merged against the default branch as appropriate to the project policy.
- **Secrets:** Never commit tokens, keys, or `.env` with real credentials. Use secret managers, GitHub Secrets, or local git-ignored files.
- **History:** Avoid rewriting shared history without team agreement. Prefer `git revert` for public fixes on main when others depend on the graph.
- **Hooks and config:** Align with project `pre-commit` / CI checks; do not bypass hooks to land broken formatting or tests.

## GitHub CLI (`gh`)

- **Auth:** `gh auth login` for interactive use; `GH_TOKEN` (or `GITHUB_TOKEN` in Actions) for automation. Scope tokens to the minimum required.
- **Repo context:** `gh repo set-default owner/repo` in a clone reduces repeated `--repo` flags.
- **Automation-friendly output:** Prefer `--json` and `--jq` over scraping human tables in scripts.

Full command map, environment variables, and doc links: [reference/gh-cli.md](reference/gh-cli.md).

## GitHub Actions (high level)

- **Permissions:** Declare minimal `permissions:` at workflow or job level; default broad scopes are rarely needed for build/test.
- **Secrets and untrusted input:** Use `secrets.*` for sensitive values; avoid interpolating `github.event` fields directly into `run:` shells (see [reference/github-actions.md](reference/github-actions.md)).
- **Forks and `pull_request_target`:** Treat as high risk; never check out arbitrary fork refs in a context that can reach secrets without an explicit, reviewed pattern.
- **Performance:** Use path filters, concurrency groups, caching, and matrix design intentionally; skip redundant setup when the runner image already provides the tool (confirm via runner image docs in the reference).
- **Supply chain:** Pin third-party actions to a commit SHA when policy requires; keep actions updated (Dependabot or equivalent).

Structured checklist, official documentation links, and patterns for clean workflows: [reference/github-actions.md](reference/github-actions.md).

## When this skill is not enough

- **Enterprise or org policy:** Follow internal security and compliance rules over generic advice here.
- **Deep Git internals:** Use project docs or a dedicated Git reference for advanced history surgery.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [kaynetik](https://github.com/kaynetik)
- **Source:** [kaynetik/skills](https://github.com/kaynetik/skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-kaynetik-skills-gh
- Seller: https://agentstack.voostack.com/s/kaynetik
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.