github-cli

A set of working rules for GitHub’s command-line tool, which lets scripts and developers manage pull requests, issues, releases, and automated checks.

In plain words
What is it for?
Use it when creating or managing pull requests, issues, releases, or CI workflows with the gh command.
Why use it?
It reduces authentication mistakes, missing review requirements, and other silent failures when automating GitHub work.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/sordi-ai/skill-everything/github-cli
Clone the repo
git clone --depth 1 https://github.com/sordi-ai/skill-everything

Made for: Cursor.

Per session 22 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 759 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00022 $0.00759
Opus 5 $0.00011 $0.00380
Sonnet 5 $0.00004 $0.00152
Haiku 4.5 $0.00002 $0.00076

Measured yesterday against content hash f397c934b6e9, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

github-cli scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

12. **Use `gh api` for endpoints not covered by subcommands.** Prefer `gh api repos/{owner}/{repo}/pulls --jq '.[].number'` over raw `curl` with manual auth headers; `gh api` inherits the active auth context automaticall
.cursor/rules/github-cli.mdc · 48 lines

How it starts

The opening of the file, as written. The whole thing — 48 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Sub-Skill: GitHub CLI (gh) Conventions

Purpose: Consistent, auditable use of the gh CLI for PRs, issues, releases, and CI — preventing gate bypasses and silent failures.


Rules

Authentication & Scopes

  1. Check auth scope before scripting. Before running gh in CI or scripts, always verify the required scopes are granted with gh auth status; missing scopes produce silent 404s rather than auth errors.
  2. Use token env var in CI. Always pass GH_TOKEN (or GITHUB_TOKEN) via environment variable in CI pipelines; never hard-code tokens or use gh auth login --with-token interactively in automated contexts.

Pull Requests

  1. Include all required labels on PR creation. Always pass --label for every gate-required label when running gh pr create; omitting a label silently bypasses automated approval gates. Reference: ERR-2026-023
  2. Set reviewer on creation. Always use --reviewer <handle> when creating PRs that require CODEOWNERS approval; adding reviewers after creation delays the review clock.
  3. Open as draft when work is incomplete. Use gh pr create --draft for PRs not yet ready for review; never open a ready-for-review PR on a branch with failing CI.
  4. Link issues explicitly. Always include --body "Closes #<issue>" or --body "Fixes #<issue>" so GitHub auto-closes the linked issue on merge; never rely on branch name alone for issue linkage.

Issues

  1. Assign and label on creation. Use gh issue create --assignee @me --label <label> rather than creating bare issues and editing them in a second step; unassigned, unlabelled issues fall out of triage queues.
  2. Use JSON output for scripting. Prefer gh issue list --json number,title,labels over parsing human-readable output; the --json flag is stable across gh versions, plain text is not.

CI / Workflows

  1. Trigger runs explicitly when needed. Use gh workflow run <workflow.yml> --ref <branch> to trigger a workflow rather than pushing an empty commit; empty commits pollute history.
  2. Watch run status in scripts. After triggering a workflow, use gh run watch <run-id> or poll gh run view <run-id> --json conclusion rather than sleeping for a fixed duration.

Read the full file on GitHub · 48 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 48 lines · 22 tokens per session scan A f397c934b6e9

Subscribe to this mod's changes

github-cli is a cursor rule published in the GitHub repository sordi-ai/skill-everything (19 stars, last pushed 3mo ago), licensed MIT. It adds 22 tokens to every session and 759 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.