gh-cli-setup
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECREDENTIALS_UNSAFEPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill includes the command
gh auth status --show-tokenin the 'Quick Diagnostic' section. If an agent executes this command and includes the full output in its response, it will expose the user's active GitHub authentication token in cleartext within the chat history. - [PRIVILEGE_ESCALATION]: Installation instructions for Linux distributions (Debian/Ubuntu, Fedora, Arch) and macOS (via MacPorts) utilize
sudoto perform high-privilege operations such as repository configuration, GPG key management, and package installation. - [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the official GitHub CLI GPG keyring and packages from
cli.github.com. These references target a well-known service for legitimate software distribution. - [COMMAND_EXECUTION]: The instructions rely heavily on the execution of shell commands to verify installation (
which gh), check status (gh auth status), configure environments (gh config set), and manage the software lifecycle.
Audit Metadata