Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HezaoHezao/poirot --skill github-authgit clone --depth 1 https://github.com/HezaoHezao/poirotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hezaohezao/poirot/github-auth)<a href="https://agentmods.dev/skills/hezaohezao/poirot/github-auth"><img src="https://agentmods.dev/badge/skills/hezaohezao/poirot/github-auth/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hezaohezao/poirot/github-auth"><img src="https://agentmods.dev/badge/skills/hezaohezao/poirot/github-auth.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 9 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 35 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 61 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 68 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 72 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 75 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 141 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Data Exfiltration · line 116 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 143 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- low Supply Chain · line 116 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00017 | $0.01056 |
| Opus 5.5 | $0.00007 | $0.00422 |
| Sonnet 5.5 | $0.00003 | $0.00211 |
| Haiku 4.5 | $0.00002 | $0.00106 |
Grade A, and why
github-auth scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Authentication Setup
Sets up authentication so the agent can work with GitHub repositories, PRs, issues, and CI.
Detection Flow
When a user asks to work with GitHub, run this check first:
git --version
gh --version 2>/dev/null || echo "gh not installed"
gh auth status 2>/dev/null || echo "gh not authenticated"
git config --global credential.helper 2>/dev/null || echo "no git credential helper"
Decision tree:
- If
gh auth statusshows authenticated → useghfor everything - If
ghinstalled but not authenticated → use "gh auth" method - If
ghnot installed → use "git-only" method
Method 1: Git-Only (No gh)
HTTPS with Personal Access Token (Recommended)
Step 1: Create a token at https://github.com/settings/tokens (classic)
or https://github.com/settings/personal-access-tokens (fine-grained). Scope:
repo, workflow, read:org.
Step 2: Configure git credential helper:
# Store credentials (plaintext, dev machine only)
git config --global credential.helper store
# Or use a credential cache (timed, more secure)
git config --global credential.helper 'cache --timeout=3600'
Step 3: First push triggers prompt:
# Username: your GitHub username
# Password: paste your token (not your GitHub password)
git push origin main
Step 4 (optional): Set token as env var for API calls:
export GITHUB_TOKEN="ghp_xxxxxxxxxxxx"
# Add to .env for persistence
SSH Keys
# Generate key (if no existing key)
ssh-keygen -t ed25519 -C "[email protected]" -f ~/.ssh/id_ed25519_github
# Start ssh-agent
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519_github
# Copy public key
cat ~/.ssh/id_ed25519_github.pub
# Paste at https://github.com/settings/keys
# Test
ssh -T [email protected]
# Set remote to SSH
git remote set-url origin [email protected]:owner/repo.git
Method 2: gh CLI
# Install gh (if not present)
# macOS: brew install gh
# Linux: see https://github.com/cli/cli#installation
# Windows: winget install GitHub.cli
# Authenticate
gh auth login
# Follow prompts: choose HTTPS or SSH, authenticate via browser or token
# Verify
gh auth status
# Use gh for everything
gh repo clone owner/repo
gh pr create
gh issue list
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 150 lines · 17 tokens per session scan E 834a0a867e0c
github-auth is a skill published in the GitHub repository HezaoHezao/poirot (251 stars, last pushed 2mo ago), licensed MIT. It adds 17 tokens to every session and 1,056 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
commit
Atomic git commit with conventional message. Use when the user says "commit", "save my changes", "commit this", or wants to create a git commit. Stages specific files, writes a conventional commit message with body explaining non-obvious decisions. Never uses git add -A.
pipeline-conductor
Operating procedure for the kirocrew-pipeline-conductor agent. Use when a pipeline conductor session is seeded, inspected or debugged. You MANAGE one issue/PR pipeline on one repo: two columns per item (session working? item solved?), send intent, never re-derive a red yourself.
release-notes
Draft a release note section from a commit range, grouped by what the reader gets.
kirocrew-prepare-pr
LOAD THIS FOR EVERY KIRO CREW PR you open or update (Kiro Crew repo only; not other repos or CRs). Runs the whole loop — issue + tier, commit, sync, squash, push, drive CI and AI review to green, fix a red main, arm auto-merge and watch it land (24h). 'push my changes' = prepare-only.
kirocrew-worktree-dev
HARD RULE for developing the Kiro Crew source repo ITSELF (not users' projects): develop, build and verify in a git worktree, never against the live gateway. Covers env setup, main-clone sync, build/dist ordering, flags, previews, cleanup, publish authorization; kirocrew-prepare-pr owns PRs.
python-run
Run and debug Python scripts in the project. Use when the user says "run python", "execute this script", "debug this py file", or wants to run/modify a .py file. Handles dependency checks, linting, execution, and error analysis.