← All skills
gh-cli
90 / 100 · Low risk
Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.
By trailofbits/skills (GitHub) · coding · 8,130 stars · scanned at commit e4dd0bb
Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: api.github.com, example.com, pypi.org, github.com, raw.githubusercontent.com, gist.github.com
The author does not mention this. It runs automatically when the plugin is installed.
Found in 31 places.
Show 17 more
- plugins/gh-cli/hooks/hooks.json, line 26
"matcher": "WebFetch|mcp__.*([Ff]etch|[Ss]crape|[Cc]rawl|[Ee]xtract)", - plugins/gh-cli/hooks/intercept-github-curl.bats, line 11
run_curl_hook_no_gh "curl https://api.github.com/repos/owner/repo" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 112
run_curl_hook "curl https://example.com/api/data" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 117
run_curl_hook "curl https://pypi.org/pypi/requests/json" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 122
run_curl_hook "wget https://example.com/file.tar.gz" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 127
run_curl_hook "curl http://localhost:8080/api/health" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 136
run_curl_hook 'curl -s "https://api.github.com/repos/astral-sh/python-build-standalone/releases/latest" | head -200' - plugins/gh-cli/hooks/intercept-github-curl.bats, line 142
run_curl_hook 'curl -H "Authorization: token ghp_xxx" https://api.github.com/repos/owner/repo/pulls' - plugins/gh-cli/hooks/intercept-github-curl.bats, line 148
run_curl_hook "curl https://api.github.com/repos/owner/repo/issues" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 154
run_curl_hook "curl https://api.github.com/repos/owner/repo/commits" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 164
run_curl_hook "wget https://github.com/owner/repo/archive/refs/tags/v1.0.tar.gz" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 170
run_curl_hook "curl https://raw.githubusercontent.com/owner/repo/main/README.md" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 176
run_curl_hook "curl https://gist.github.com/user/abc123" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 186
run_curl_hook 'curl -s https://api.github.com/repos/owner/repo/releases | head -50' - plugins/gh-cli/hooks/intercept-github-curl.bats, line 191
run_curl_hook 'curl -s https://api.github.com/repos/owner/repo/releases | jq ".[0].tag_name"' - plugins/gh-cli/hooks/intercept-github-curl.bats, line 200
run_curl_hook "curl -s https://api.github.com/repos/owner/repo" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 205
run_curl_hook "curl -L https://github.com/owner/repo/releases/download/v1.0/binary"
and 11 more places
Runs commands on your computer
The author does not mention this. It runs automatically when the plugin is installed. Expected for a coding skill.
Found in 40 places.
Show 17 more
- plugins/gh-cli/hooks/hooks.json, line 30
"command": "bash \"${CLAUDE_PLUGIN_ROOT:-.}/hooks/intercept-github-fetch.sh\"" - plugins/gh-cli/hooks/hooks.json, line 39
"command": "bash \"${CLAUDE_PLUGIN_ROOT:-.}/hooks/intercept-github-curl.sh\"" - plugins/gh-cli/hooks/hooks.json, line 50
"command": "bash \"${CLAUDE_PLUGIN_ROOT:-.}/hooks/cleanup-clones.sh\"" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 16
run bash -c 'echo "not json" | '"'$CURL_HOOK'" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 21
run bash -c 'echo "{}" | '"'$CURL_HOOK'" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 26
run bash -c 'echo "{\"tool_input\":{\"command\":\"\"}}" | '"'$CURL_HOOK'" - plugins/gh-cli/hooks/intercept-github-curl.bats, line 31
run bash -c 'echo "{\"tool_input\":{}}" | '"'$CURL_HOOK'" - plugins/gh-cli/hooks/intercept-github-fetch.bats, line 16
run bash -c 'echo "not json" | '"'$FETCH_HOOK'" - plugins/gh-cli/hooks/intercept-github-fetch.bats, line 21
run bash -c 'echo "{}" | '"'$FETCH_HOOK'" - plugins/gh-cli/hooks/intercept-github-fetch.bats, line 26
run bash -c 'echo "{\"tool_input\":{\"url\":\"\"}}" | '"'$FETCH_HOOK'" - plugins/gh-cli/hooks/intercept-github-fetch.bats, line 31
run bash -c 'echo "{\"tool_input\":{}}" | '"'$FETCH_HOOK'" - plugins/gh-cli/hooks/intercept-github-fetch.bats, line 229
run bash -c 'echo "{\"tool_input\":{\"urls\":[]}}" | '"'$FETCH_HOOK'" - plugins/gh-cli/hooks/intercept-github-fetch.bats, line 270
run bash -c 'jq -n '"'"'{"tool_input":{"url":"https://example.com","urls":["https://gist.github.com/user/abc123"]}}'"'"' | '"'$FETCH_HOOK'" - plugins/gh-cli/hooks/intercept-github-fetch.bats, line 276
run bash -c 'echo "{\"tool_input\":{\"urls\":\"https://github.com/owner/repo\"}}" | '"'$FETCH_HOOK'" - plugins/gh-cli/hooks/intercept-github-fetch.bats, line 282
run bash -c 'echo "{\"tool_input\":{\"urls\":\"https://pypi.org/project/requests/\"}}" | '"'$FETCH_HOOK'" - plugins/gh-cli/hooks/intercept-github-fetch.bats, line 287
run bash -c 'jq -n '"'"'{"tool_input":{"urls":[null,42,""]}}'"'"' | '"'$FETCH_HOOK'" - plugins/gh-cli/hooks/session-hooks.bats, line 12
run bash -c 'echo "not json" | "$1"' _ "$PERSIST_HOOK"
and 20 more places
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'gh-cli' ] || [ -L ~/.agents/skills/'gh-cli' ]; then echo 'A skill folder named gh-cli already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/trailofbits/skills' "$d" && git -C "$d" checkout --quiet 'e4dd0bb5b15535f7c5a0834187dffba6ac37e4ff' -- 'plugins/gh-cli/skills/gh-cli' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/gh-cli/skills/gh-cli' ~/.agents/skills/'gh-cli' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'gh-cli' ~/.claude/skills/'gh-cli' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for trailofbits/skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/trailofbits/skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | e4dd0bb | 90 |
| 2026-11-07 | e4dd0bb | 90 |