skills.rest
Lynricsy
LynricsyCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

github

Manages GitHub pull requests, issues, Actions workflows, releases, and repository settings.

22|Updated Sep 10, 2026
Search Tags:#github#github actions#pull requests#gh cli#issue triage#ci/cd security#workflow audit
One-click install
npx skills add https://github.com/Lynricsy/HyperSkills --skill github-lynricsy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: github
Source: https://github.com/Lynricsy/HyperSkills/tree/main/skills/github
Command: npx skills add https://github.com/Lynricsy/HyperSkills --skill github-lynricsy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Working with GitHub involves subtle traps: privileged Actions triggers that leak secrets to fork PRs, closing keywords that silently fail on non-default branches, CODEOWNERS rules that never gate merges, and gh CLI quirks that break multi-line PR bodies. This Skill encodes the audited, version-accurate rules for operating GitHub's platform safely and correctly. ## Core Features & Use Cases - Actions security auditing: Classify workflow triggers by trust level, trace script-injection and pwn-request paths, enforce least-privilege permissions, SHA pinning, and OIDC, with zizmor output treated as leads rather than findings. - Pull request lifecycle: Write reviewer-facing PR bodies via --body-file, link issues correctly across branches, watch CI with gh pr checks, and reply to inline review threads through the GraphQL reviewThreads API. - Issue triage and repository governance: Deduplicate and classify issues with types or labels, configure rulesets, CODEOWNERS, Dependabot, and environments, and cut releases from git tags with draft-then-publish ordering. - Use Case: Ask it to review a pr-triage.yml workflow and it will flag the pull_request_target job executing fork code, the ${{ }} injection sinks, the unpinned third-party actions, and the long-lived AWS secrets, then produce corrected YAML. ## Quick Start Ask the agent to audit the workflows in .github/workflows for security issues and propose fixed YAML using the github skill.

Frequently Asked Questions about github

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure a GitHub Actions workflow against fork pull request attacks?▼

Classify the trigger first: pull_request from forks is read-only by design, while pull_request_target runs with a write token and secrets. Never let a privileged job execute PR code; split into an unprivileged pull_request job that builds and a privileged workflow_run job that consumes only its output.

How do I fix script injection in GitHub Actions run blocks?▼

Bind the untrusted ${{ }} expression to an env: variable and reference the quoted shell variable in the run: block, for example env: TITLE: ${{ github.event.issue.title }} then echo "$TITLE". Interpolation is text substitution into the shell, so escaping in place does not work.

Why didn't my Closes #issue keyword close the issue when the PR merged?▼

Closing keywords are only interpreted when the pull request targets the repository's default branch. A PR onto a release branch ignores the keyword entirely, so link the issue manually and close it by hand after merging.

Does CODEOWNERS block merges on its own?▼

No. CODEOWNERS only requests reviews; the merge gate comes from enabling required reviews plus require review from Code Owners in a ruleset or branch protection rule. The file must live on the base branch and every listed owner needs write access.

Should I pin GitHub Actions to a SHA or a version tag?▼

Pin third-party actions and reusable workflows to a full 40-character commit SHA with the version in a trailing comment, because tags are movable pointers. Keep pins maintainable with a Dependabot github-actions ecosystem entry, and enforce the policy at the repository or organization level.

What are the limits of this GitHub skill?▼

It covers GitHub the platform only: Actions, PRs, issues, releases, and repository settings. Purely local git work belongs to a git-workflow skill, judging code correctness belongs to a code-review skill, and non-GitHub CI platforms are out of scope.

Related Skills

Explore More Software Engineering Skills→
BedaBeda-GrowthBedaBeda-Growth

git-clean

Detect uncommitted changes in local Git branches and push them to remote.

Official
Advanced
softwaresaltsoftwaresalt
1

operational-closure

Generate dated closure markdown files with monitoring and rollback plans.

Community
Advanced
offlinecvofflinecv
8

pr-review

Review pull requests against issue acceptance criteria and architectural gates.

Official
Advanced
maschadmaschad
6

ci-validation

Validate CI/CD configurations across multiple platforms and run local checks.

Community
Advanced