# Github Operations

> Authenticate GitHub operations with ghtkn and fall back to an available GitHub connector when needed.

- Skill: `horizon67/github-operations` (Agent Skill)
- Install (CLI): `npx skillmds@latest add horizon67/github-operations`
- Raw SKILL.md: https://api.skillmd.com/api/skills/horizon67/github-operations/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: horizon67 (https://skillmd.com/u/horizon67)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/horizon67/github-operations

---


# GitHub Operations

Use ordinary `git` commands for local work that does not require GitHub authentication, such as inspecting changes, creating commits, and managing local branches.

For authenticated GitHub operations, prefer [ghtkn](https://github.com/suzuki-shunsuke/ghtkn) when both `ghtkn` and the required command-line tool are available.

## Use ghtkn

Run routine GitHub CLI commands with the token confined to the child process:

```sh
ghtkn exec -e GH_TOKEN -- gh <arguments>
```

Never use `ghtkn get` in an agent workflow, assign its output to a variable, or print a token. Keep the required `--` separator in `ghtkn exec` commands.

When setup, an unfamiliar option, or an error requires more detail, consult the installed version's embedded documentation:

```sh
ghtkn docs list
ghtkn docs show exec
```

Read only the relevant topic, such as `exec` for command execution, `git-credential-helper` for HTTPS Git setup, or `troubleshooting` for token acquisition failures.

For Git operations over HTTPS, use ghtkn's Git credential helper when it is already configured. If the task is to configure it, first read `ghtkn docs show git-credential-helper` and follow the installed version's instructions. Respect the repository's existing remote protocol and do not silently rewrite an SSH remote to HTTPS.

## Reauthentication

When authentication expires or ghtkn requires interactive authentication, ask the user to run `ghtkn auth` in their own terminal. Treat session expiry, including the eight-hour authentication expiry, as a reason to reauthenticate rather than immediately switching to a connector.

If authentication must target a specific GitHub App, inspect the current ghtkn configuration to identify the appropriate App and guide the user to run `ghtkn auth <app-name>`, replacing the placeholder with the configured name. Consult the installed documentation if needed to locate or interpret the configuration; do not guess the App name or expose credentials.

Wait for the user to confirm authentication is complete before resuming the blocked operation. Continue independent authorized local work while waiting.

## Connector fallback

When ghtkn is missing, blocked for a reason other than pending interactive authentication, misconfigured, or unable to perform the requested operation, use an available GitHub connector or GitHub app tool instead. For authentication expiry, follow the reauthentication guidance first; use a connector if the user cannot reauthenticate or requests that fallback. Preserve the requested repository and operation scope when switching tools.

If neither path can perform the operation, stop authentication retries and report the specific blocker and smallest user action needed. Continue independent local work that is authorized. Do not bypass the failure by exposing or requesting a long-lived token.