Skip to content
Security
Skill

/gh-cli

Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.

From plugin
trailofbits-skills
7.1k81 skills30 agents8 commands2 MCP
Install
$ npx -y skills add trailofbits/skills --skill gh-cli --agent claude-code

How it fires

How this skill gets triggered: by you, by Claude, or both.

  • Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
  • You can call itInvoke it directly when you want it.
  • Slash command/gh-cli

Context preview

The summary Claude sees to decide when to auto-load this skill.

Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.

SKILL.md

gh-cli.SKILL.md
name: gh-cli
description: Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.

gh-cli

When to Use

  • Working with GitHub repositories, pull requests, issues, releases, or raw file URLs.
  • You need authenticated access to private repositories or higher API rate limits.
  • You are about to use `curl`, `wget`, `WebFetch`, or an MCP fetch tool against GitHub.

When NOT to Use

  • The target is not GitHub.
  • Plain local git operations already solve the task.

Guidance

Prefer the authenticated `gh` CLI over raw HTTP fetches for GitHub content. In particular:

  • Prefer `gh repo view`, `gh pr view`, `gh pr list`, `gh issue view`, and `gh api` over unauthenticated `curl` or `wget`.
  • Prefer cloning a repository and reading files locally over fetching `raw.githubusercontent.com` blobs directly.
  • Avoid using GitHub API `/contents/` endpoints as a substitute for cloning and reading repository files.

Examples:

gh repo view owner/repo
gh pr view 123 --repo owner/repo
gh api repos/owner/repo/pulls

For the hook implementation, see:

  • `plugins/gh-cli/README.md`
  • `plugins/gh-cli/hooks/`
Ships withtrailofbits-skills

A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.

Get the whole plugin

Other skills on trailofbits-skills.