Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

gh-cli — measured AI agent skill | DecimalAI

trailofbits/gh-cli

SkillScore83Maintained

Enforces authenticated gh CLI workflows over unauthenticated curl/WebFetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.

by trailofbits

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Coding pack

decimalai skills pull trailofbits-gh-cli

Get this skill — curl · raw file

curl -fsSL https://app.decimal.ai/s/trailofbits-gh-cli/SKILL.md

Raw file: /s/trailofbits-gh-cli/SKILL.md ↗ · machine-readable summary at /s/trailofbits-gh-cli.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

24 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 2d ago

—-29% tokens0% turns83% of whole cases pass with skill (20/24)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-12	✗→✓	▲ Improved	-13%	0%
case-15	✗→✓	▲ Improved	-52%	0%
case-18	✗→✓	▲ Improved	-4%	0%
case-21	✗→✓	▲ Improved	-56%	0%
case-24	✗→✓	▲ Improved	-43%	0%

Showing 5 of 24 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

trailofbits / skills

plugins/gh-cli/skills/gh-cli/SKILL.md

View on GitHub ↗

License CC-BY-SA-4.0Imported 8/3/2026Version v1Bundled 1 file

Skill contents

assets/

SKILL.md

gh-cli

When to Use

Working with GitHub repositories, pull requests, issues, releases, or raw file URLs.
You need authenticated access to private repositories or higher API rate limits.
You are about to use curl, wget, or unauthenticated web fetches against GitHub.

When NOT to Use

The target is not GitHub.
Plain local git operations already solve the task.

Guidance

Prefer the authenticated gh CLI over raw HTTP fetches for GitHub content. In particular:

Prefer gh repo view, gh pr view, gh pr list, gh issue view, and gh api over unauthenticated curl or wget.
Prefer cloning a repository and reading files locally over fetching raw.githubusercontent.com blobs directly.
Avoid using GitHub API /contents/ endpoints as a substitute for cloning and reading repository files.

Examples:

sh
gh repo view owner/repo
gh pr view 123 --repo owner/repo
gh api repos/owner/repo/pulls

For the hook implementation, see:

plugins/gh-cli/README.md
plugins/gh-cli/hooks/

Want to see if trailofbits/gh-cli would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.