github-cli-ops

Overview

This skill lets an agent perform any GitHub operation, CLI-first: it uses the gh CLI for everything gh covers — the ergonomic path that also encrypts secrets and shapes output — and falls back to gh api (REST) only where no gh command exists, with gh api graphql for the GraphQL-only corners. Authentication is per-call: every invocation is prefixed with GH_TOKEN="$<token var>" from the caller-injected token, so nothing global is ever mutated. gh already manages base URL, pagination, and output, so the agent does not reimplement HTTP plumbing. For the REST long tail, the agent looks up an endpoint in a bundled OpenAPI spec via an endpoint index + a $ref-resolver, then constructs the gh api call.

When to activate

• ✅ Performing a GitHub operation that has a first-class command — issues, pull requests, repos, releases, labels, gists, Actions runs/workflows, Projects, secrets, etc. (gh <command>).
• ✅ A REST operation with no first-class command — construct it via gh api <endpoint>.
• ✅ A GraphQL-only need (e.g. Discussions) — gh api graphql.
• ✅ A write you need done programmatically against github.com.

Do NOT activate when:

• The task is a local/interactive gh action — gh auth …, gh browse, gh repo clone, gh pr checkout, gh config, gh alias, gh extension, gh completion. Those are local conveniences, not API operations; use gh/git directly.
• The target is GitHub Enterprise Server as a first-class need (this skill is github.com in v1; an Enterprise host routes via the injected host + GH_HOST/GH_ENTERPRISE_TOKEN but is untested here).
• You only need credential setup — credentials are provided by the caller; this skill does not provision or resolve them (see references/auth.md for the contract it consumes).