Skip to content
Back to skills

Github

ASecurity

Interact with GitHub repositories, issues, pull requests, and commits via the GitHub REST API. Use when the user mentions GitHub, repos, repositories, issues, PRs, pull requests, commits, releases, or asks to push/clone/fetch from GitHub.

  • 3 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added October 9, 2026
ai-agentsshellbashgitapi

Works with

  • cli
  • api

Security analysis

A96/100
  • mediumUses curl or wget to download content

Pro shows the line behind each finding and how to fix it

Scanned October 9, 2026

npx -y skills add julienR2/jarvis --skill github --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Github?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Github
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/julienr2-github/badge)](https://www.skillsdirectory.com/skills/julienr2-github)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: github
description: Interact with GitHub repositories, issues, pull requests, and commits via the GitHub REST API. Use when the user mentions GitHub, repos, repositories, issues, PRs, pull requests, commits, releases, or asks to push/clone/fetch from GitHub.
allowed-tools: Bash, Read, Write
---

# GitHub Skill

Access GitHub via the REST API and via `git`/`gh` over HTTPS.

## Credentials

Uses the **`github`** connector → sets `$GITHUB_TOKEN` (Personal Access Token, classic or fine-grained). Load it per *Connectors* in CLAUDE.md, in the same shell block as the commands that use it, then `export GH_TOKEN="$GITHUB_TOKEN"` for the gh CLI.

- **API base:** `https://api.github.com`
- **Git push URL pattern:** `https://x-access-token:${GITHUB_TOKEN}@github.com/<owner>/<repo>.git`

---

## REST API basics

All requests require these headers:

```bash
curl -s https://api.github.com/user \
  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  -H "X-GitHub-Api-Version: 2022-11-28"
```

### Who am I

```bash
curl -s https://api.github.com/user \
  -H "Authorization: Bearer ${GITHUB_TOKEN}"
```

### List my repos

```bash
curl -s "https://api.github.com/user/repos?per_page=100&sort=updated" \
  -H "Authorization: Bearer ${GITHUB_TOKEN}"
```

### List issues / PRs assigned to me

```bash
curl -s "https://api.github.com/issues?filter=assigned&state=open" \
  -H "Authorization: Bearer ${GITHUB_TOKEN}"
```

### Create an issue

```bash
curl -s -X POST https://api.github.com/repos/OWNER/REPO/issues \
  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  -d '{"title":"Bug: …","body":"Details…","labels":["bug"]}'
```

### Create a PR

```bash
curl -s -X POST https://api.github.com/repos/OWNER/REPO/pulls \
  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
  -d '{"title":"…","head":"feature-branch","base":"main","body":"…"}'
```

---

## Pushing code from inside the container

Set the remote with the embedded token, then `git push` works without prompting:

```bash
git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/OWNER/REPO.git"
git push origin main
```

For a one-off push without changing the remote:

```bash
git push "https://x-access-token:${GITHUB_TOKEN}@github.com/OWNER/REPO.git" HEAD:main
```

---

## Common use cases

| Task | Endpoint / command |
|---|---|
| List my open PRs | `GET /search/issues?q=is:pr+is:open+author:@me` |
| Find an issue by text | `GET /search/issues?q=…` |
| Comment on an issue/PR | `POST /repos/OWNER/REPO/issues/:n/comments` |
| Latest release of a repo | `GET /repos/OWNER/REPO/releases/latest` |
| Repo file contents | `GET /repos/OWNER/REPO/contents/PATH` |
| Push commits | `git push` with token-embedded URL |

## Notes

- Fine-grained tokens scope to specific repos — if a request returns 404 or 403, the token may not cover that repo.
- The Search API is rate-limited to 30 req/min. Regular endpoints: 5000 req/hour.
- `gh` CLI works too: `GH_TOKEN=${GITHUB_TOKEN} gh pr list --repo OWNER/REPO`.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.