github-ops

A skill for managing GitHub repositories and related remote work through the gh command-line tool.

In plain words
What is it for?
It helps create repositories, push releases, manage issues and pull requests, configure repository details, and perform read-only security audits.
Why use it?
It gathers repository creation, releases, issues, pull requests, metadata, and security checks in one documented workflow with previews before sending changes.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/0xdarkmatter/claude-mods/github-ops
Any agent
npx skills add 0xDarkMatter/claude-mods --skill github-ops
Clone the repo
git clone --depth 1 https://github.com/0xDarkMatter/claude-mods

Made for: Claude Code, Codex.

Per session 67 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 6,624 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00067 $0.06624
Opus 5 $0.00034 $0.03312
Sonnet 5 $0.00013 $0.01325
Haiku 4.5 $0.00007 $0.00662

Measured 2d ago against content hash 38fce8808ee9, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

github-ops scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 4 executable files (scripts/check-issues.sh, scripts/check-security-posture.sh, scripts/repo-scorecard.sh, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/github-ops/SKILL.md · 397 lines

How it starts

The opening of the file, as written. The whole thing — 397 lines — stays where its author put it; the contents beside it link to each section on GitHub.

GitHub Ops

GitHub-side operations skill. Owns everything that talks to api.github.com via gh CLI: repo creation, metadata configuration, releases, and the conventions that govern how 0xDarkMatter repos present on GitHub.

Sits alongside two related skills:

LOCAL                          BRIDGE              REMOTE (GitHub)
─────                          ──────              ───────────────
git-ops                        push-gate           github-ops  (this skill)
Concern Owner
Commits, branches, local tags, rebases, worktrees, stash git-ops
Pre-push secret scan + dirty-tree refusal + confirm push-gate
gh repo create, push to remote, tag push github-ops
Repo description / homepage / topics / visibility github-ops
gh release create + release notes github-ops
README "Recent Updates" section maintenance github-ops
Package metadata audit (pyproject/package.json ↔ GH topics ↔ tag ↔ version) github-ops
gh issue operations (view/list/create/comment/edit/triage/close) github-ops
gh pr operations (view/list/diff/checks/create/comment/review/edit/merge/close) github-ops
Security posture audit (Dependabot / secret+code scanning / PVR / SECURITY.md / branch protection) — read-only github-ops (scripts/check-security-posture.sh)
Actions / secrets / social preview / branch-protection writes github-ops (future)

Hard rules

  1. Visibility defaults to private. Pass --private to gh repo create unless the user has explicitly said "public" / "make it public" for this specific repo. See references/repo-visibility.md.
  2. Major version bumps require explicit approval. Default to minor; patch for fix-only ranges. Never auto-suggest a 1.0.0 from BREAKING CHANGE: markers — surface and ask. See references/release-strategy.md.
  3. Always run push-gate before any push to a remote. No exceptions. If push-gate refuses, do not proceed — fix the cause and re-run.
  4. Delegate local git operations to git-ops. Don't reimplement commit/tag/push logic. github-ops orchestrates the GitHub-side calls (gh) and the README/CHANGELOG edits; git-ops handles git itself.
  5. README "Recent Updates" updates on every release. This is the one README touch that always happens, regardless of how minor the release. See references/readme-recent-updates.md for the canonical claude-mods style.
  6. Never push without confirming visibility decision. When creating a new repo, surface visibility as a flippable line in the plan ("creating as private — say 'public' to flip"), not buried in flag soup.
  7. No local-machine paths in committed content. Never bake C:\Users\<name>\…, /home/<name>/…, /Users/<name>/…, /tmp/<one-off-test-dir>, or any other machine-specific path into README entries, Recent Updates bullets, CHANGELOG entries, release notes, tag annotations, or commit messages. Public release artefacts have to read the same on someone else's machine. Use generic placeholders (~/Temp/, <temp-dir>, "a temp directory") or describe the file's purpose abstractly instead. If a path genuinely is part of the project's public API (install location, config path), state it canonically ($HOME/.claude/skills/...), not as a literal absolute that includes a user name.
  8. Preview every public post before sending. Anything with author voice that lands on a third-party surface — gh issue create/comment/edit --body, gh pr create/comment/review/edit --body, gh release create --notes, merge commit --subject/--body — must be quoted verbatim in chat with the exact send command named, then await explicit approval before invoking. Mechanical actions with no body (label, assign, milestone, mark-ready, close-without-message) skip preview. See ~/.claude/rules/public-posts.md for the full rule.

Read the full file on GitHub · 397 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 397 lines · 67 tokens per session scan A 38fce8808ee9

Subscribe to this mod's changes

github-ops is a skill published in the GitHub repository 0xDarkMatter/claude-mods (32 stars, last pushed 10d ago), licensed MIT. It adds 67 tokens to every session and 6,624 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

push-release

Push to GitHub and optionally bump version to trigger PyPI release.

liaohch3/claude-tap · 16 tokens

omh-deploy-and-monitor

This is a Hermes-native deploy-and-monitor workflow skill.

rlaope/oh-my-hermes · 66 tokens

git-wrapup

Land working-tree changes as logical commits — the work grouped by concern, topped by a release commit (version bump, changelog, regenerated artifacts) and an annotated tag. Verify, commit, tag. Stops at "committed and tagged locally" — no push, no publish. The release-and-publish skill picks up from here. Distilled…

cyanheads/obsidian-mcp-server · 82 tokens

release-and-publish

Ship a release end-to-end across every registry the project targets (npm, MCP Registry, GitHub Releases for .mcpb bundles, GHCR). Runs the final verification gate, pushes commits and tags, then publishes to each applicable destination. Assumes git wrapup (version bumps, changelog, commit, annotated tag) is already…

cyanheads/obsidian-mcp-server · 112 tokens

release

Cut a new SlackCLI release end to end — survey commits since the last tag, recommend a SemVer bump, open the release issue, prepare the version bump and CHANGELOG promotion on a branch, open the linked PR, and after merge push the annotated tag that publishes binaries and updates the Homebrew tap. Use when asked to…

shaharia-lab/slackcli · 87 tokens

release-notes

Draft user-facing release notes from a git log range. Trigger when the user asks for "release notes", "changelog entry", or "what shipped this week" with a git ref range. Output is markdown sections grouped by Features / Fixes / Breaking with PR links.

jnMetaCode/ai-coding-guide · 59 tokens