agentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
@trailofbitsInstall SkillSecurity
Skill
/gh-cli
Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.
Claude Code
$ npx -y skills add trailofbits/skills --skill gh-cli --agent claude-code
Codex
$ npx skills add trailofbits/skills --skill gh-cli -a codex -y
Cursor
$ npx skills add trailofbits/skills --skill gh-cli -a cursor -y
Gemini CLI
$ npx skills add trailofbits/skills --skill gh-cli -a gemini-cli -y
GitHub Copilot
$ npx skills add trailofbits/skills --skill gh-cli -a github-copilot -y
OpenCode
$ npx skills add trailofbits/skills --skill gh-cli -a opencode -y
Windsurf
$ npx skills add trailofbits/skills --skill gh-cli -a windsurf -y
SKILL.md
gh-cli.SKILL.mdname: gh-cli description: Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.
gh-cli
When to Use
- Working with GitHub repositories, pull requests, issues, releases, or raw file URLs.
- You need authenticated access to private repositories or higher API rate limits.
- You are about to use `curl`, `wget`, `WebFetch`, or an MCP fetch tool against GitHub.
When NOT to Use
- The target is not GitHub.
- Plain local git operations already solve the task.
Guidance
Prefer the authenticated `gh` CLI over raw HTTP fetches for GitHub content. In particular:
- Prefer `gh repo view`, `gh pr view`, `gh pr list`, `gh issue view`, and `gh api` over unauthenticated `curl` or `wget`.
- Prefer cloning a repository and reading files locally over fetching `raw.githubusercontent.com` blobs directly.
- Avoid using GitHub API `/contents/` endpoints as a substitute for cloning and reading repository files.
Examples:
gh repo view owner/repo gh pr view 123 --repo owner/repo gh api repos/owner/repo/pulls
For the hook implementation, see:
- `plugins/gh-cli/README.md`
- `plugins/gh-cli/hooks/`
Ships withskills
Trail of Bits skills and plugins for AI-assisted security analysis, testing, and development. Install this marketplace in Claude Code or Codex, or import it into your ChatGPT workspace marketplace.
7.9k95 skills30 agents1 MCP
Stars on GitHub
Momentum
- stars in total
- 7.9k
Other skills on skills.
@trailofbitsInstall Skillaudit-context-building
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on…
@trailofbitsInstall Skillalgorand-vulnerability…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing…
@trailofbitsInstall Skillaudit-prep-assistant
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools,…
@trailofbitsInstall Skillcairo-vulnerability-sc…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging…
@trailofbitsInstall Skillcode-maturity-assessor
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing…
@trailofbitsInstall SkillMore skills from other plugins.
api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
@zhaoxuya520Install Skillabusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Install Skillclean-user-facing-text
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…
@guillaumemeyerInstall Skill
Questions about gh-cli.
- Which coding agents can use gh-cli?
- gh-cli installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.