gh-cli

Enforces authenticated GitHub CLI workflows for repository, PR, issue, and release tasks.

1|Updated May 22, 2026
One-click install
npx skills add https://github.com/spontus-reach/spontus --skill gh-cli-spontus-reach
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: gh-cli
Source: https://github.com/spontus-reach/spontus/tree/main/.agents/skills/trailofbits-gh-cli
Command: npx skills add https://github.com/spontus-reach/spontus --skill gh-cli-spontus-reach

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It prevents slow, fragile, and rate-limited GitHub access patterns that rely on unauthenticated curl or raw web fetching by guiding you to authenticated GitHub CLI usage.

Core Features & Use Cases

  • Authenticated GitHub workflows: Use gh commands for repository, pull request, issue, release, and raw file tasks to avoid unauthenticated HTTP fetches.
  • Lower risk, higher reliability: Prefer gh repo view, gh pr view, gh pr list, gh issue view, and gh api over ad-hoc API calls or raw raw.githubusercontent.com blob fetching.
  • Better repository file handling: Prefer cloning and reading files locally instead of using GitHub API /contents/ as a replacement for proper checkout.

Quick Start

Use the gh-cli guidance to work with GitHub resources by running a command like gh pr view 123 --repo owner/repo.

Frequently Asked Questions about gh-cli

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Why does my unauthenticated GitHub API access keep hitting rate limits?

Unauthenticated GitHub API access triggers strict rate limits. Using authenticated GitHub CLI commands like `gh api` applies your token automatically, raising rate limits and preventing failed requests.

How do I view a pull request from a private repository without using curl?

View a pull request from a private repository by running `gh pr view 123 --repo owner/repo`. This authenticated GitHub CLI workflow securely accesses private data without exposing tokens in curl commands.

Should I use the GitHub API /contents/ endpoint to read repository files?

Avoid using the GitHub API /contents/ endpoint to read repository files. You should clone the repository and read files locally to prevent API misuse and ensure reliable file access.

What is the best way to fetch raw files from raw.githubusercontent.com securely?

The best way to fetch raw files securely is using authenticated `gh` commands instead of unauthenticated raw.githubusercontent.com fetching. This enforces safe GitHub API access and avoids fragile web fetches.

Can I use GitHub CLI for listing issues and viewing releases in workflows?

Yes, you can use GitHub CLI for listing issues and viewing releases. Commands like `gh issue view` and `gh release` provide authenticated, reliable access to GitHub resources for your workflows.