The Agent Skills Directory

[Authentication Token Exposure]: The skill instructs the agent to extract GitHub tokens using gh auth token and use them in command-line operations. While this avoids hardcoding, tokens passed via environment variables (e.g., $env:GH_TOKEN) or embedded in remote URLs (e.g., git push https://user:$token@...) may be briefly visible in process lists or local command history logs. The skill includes a 'Correct' example for cleaning up remote URLs after use, which is a helpful mitigation, but the transient exposure during execution remains a consideration.
[Credential Management Patterns]: The instructions encourage utilizing the GitHub CLI's credential store rather than static files, which is a positive practice. However, providing agents with the capability to switch authentication contexts and extract tokens for different users increases the scope of what the agent can access if it were to be misdirected by external input.

gh-auth-isolation