gh-auth-isolation

Identify active GitHub auth identity and isolate credentials per repository operation.

209|27|Updated Mar 10, 2026
One-click install
npx skills add https://github.com/dotnet/maui-labs --skill gh-auth-isolation-dotnet
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: gh-auth-isolation
Source: https://github.com/dotnet/maui-labs/tree/main/src/Comet/.copilot/skills/gh-auth-isolation
Command: npx skills add https://github.com/dotnet/maui-labs --skill gh-auth-isolation-dotnet

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill prevents GitHub authentication mix-ups where an AI agent uses the wrong default GitHub identity, causing failed pushes, incorrect PR authorship, or access-denied errors across enterprise and personal accounts.

Core Features & Use Cases

  • Detect the active GitHub identity for the current shell using gh auth status so the agent knows which account its gh token will represent.
  • Extract tokens for a specific account (by username) using gh auth token --user to perform a single operation under the correct identity without changing global auth state.
  • Isolate credentials via separate GH_CONFIG_DIR directories to avoid cross-account interference in long-running or multi-agent sessions, especially when working with both EMU-managed and personal repos.

Quick Start

Ask the agent to verify the current gh auth status, then extract the correct token for the target GitHub account and run the git or gh pr create action using that token for only that operation.

Frequently Asked Questions about gh-auth-isolation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I stop my AI agent from using the wrong GitHub account when pushing to personal repos?

To prevent GitHub account mixing, the agent inspects the active `gh auth status` and extracts the specific token for the target username using `gh auth token --user`, ensuring pushes authenticate with the intended identity without altering global authentication state.

Why do my pull requests from a personal fork fail when my shell defaults to an enterprise managed user account?

Pull requests fail due to credential mixing when the shell defaults to an EMU account. The Skill isolates credentials by extracting the correct personal token via `gh auth token --user` or using a separate `GH_CONFIG_DIR` for the specific operation.

How does `GH_CONFIG_DIR` isolation work for multi-account GitHub authentication?

`GH_CONFIG_DIR` isolation works by directing the GitHub CLI to use a separate configuration directory, preventing cross-account interference in long-running or multi-agent sessions where both enterprise managed and personal accounts are active.

Can I run a single `git push` or `gh pr create` under a different GitHub identity without changing my global auth state?

Yes, you can perform a single operation under a different identity by extracting the target account's token with `gh auth token --user` and applying it to that specific `git push` or `gh pr create` command without persisting or cross-contaminating global credentials.

What is the best way to manage GitHub credential isolation for AI agents handling both EMU and personal accounts?

The best way to manage GitHub credential isolation is to verify the active identity with `gh auth status`, extract account-specific tokens for single operations, and use separate `GH_CONFIG_DIR` directories to avoid cross-contamination in multi-agent workflows.