How do I install the Github Secrets skill?

Run npx skillmds@latest add sassy-dog/github-secrets in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Github Secrets safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Github Secrets?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Github Secrets free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Github Secrets?

Sassy-Dog (@sassy-dog) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Github Secrets by sassy-dog — Agent Skill

Name: Github Secrets
Author: Sassy-Dog

Github Secrets

This skill should be used when the user asks to "set a GitHub secret", "add a GitHub variable", "configure secrets for a workflow", "list GitHub secrets", "fix missing secrets in CI", "set up environment secrets", "add org secrets", "debug empty secret values in GitHub Actions", or any task involving GitHub Actions secrets, variables, or environment configuration. Also triggers when editing .github/workflows/ files that reference secrets.* or vars.* contexts.

Sassy-Dog 4e8b9d1 3 files · 13.6 KB Updated Sep 17, 2026

File contents

GitHub Secrets & Variables

GitHub secrets and variables exist at three scopes with strict precedence rules. Getting the scope wrong causes silent failures — empty values with no error.

Scope Hierarchy

Organization  →  Repository  →  Environment
(broadest)                      (most specific, wins ties)

Organization: shared across repos, set with --org
Repository: default scope, no flag needed inside a repo
Environment: requires --env flag AND environment: in the workflow job

Environment > Repository > Organization when names collide.

Secrets vs Variables — Quick Reference

	Secrets (`secrets.*`)	Variables (`vars.*`)
CLI	`gh secret`	`gh variable`
Workflow	`${{ secrets.NAME }}`	`${{ vars.NAME }}`
Encrypted	Yes	No
Readable after set	No (write-only)	Yes
Use for	Tokens, passwords, keys	URLs, flags, config

These are different namespaces. secrets.X and vars.X are not interchangeable.

Critical Rules

Always check before setting

# Secrets — can only check existence, not value
gh secret list [--org ORG] [--env ENV] | grep -q "^NAME"

# Variables — can check existence AND value
gh variable list [--org ORG] [--env ENV] --json name,value

Never try to read secret values

There is no gh secret get. Secrets are write-only. gh secret list shows names only. To update, re-set from the source of truth.

Environment secrets require `environment:` in the job

jobs:
  deploy:
    environment: production    # WITHOUT THIS, environment secrets are invisible
    steps:
      - run: echo "${{ secrets.PROD_SECRET }}"

This is the single most common mistake. Missing environment: produces empty values with zero warnings.

Scope flags are required and specific

gh secret set X --body "v"                    # repo (default)
gh secret set X --org my-org --body "v"       # org
gh secret set X --env production --body "v"   # environment

Omitting --org or --env silently creates at the wrong scope.

Workflow Contexts — Do Not Confuse

${{ secrets.NAME }}    # GitHub-managed encrypted secrets
${{ vars.NAME }}       # GitHub-managed plaintext variables
${{ env.NAME }}        # Workflow-defined env vars (env: blocks)
${{ github.token }}    # Auto-generated GITHUB_TOKEN

env.X is set in the workflow YAML with env: blocks. secrets.X and vars.X are set via gh CLI or the GitHub UI. These are completely separate systems.

Diagnostic Workflow

When a secret/variable appears missing in CI:

Verify existence: gh secret list / gh variable list with correct scope flags
Check scope: org vs repo vs environment
Check job: does it declare environment: if using environment secrets?
Check shadowing: same name at multiple scopes?
Check org visibility: if org-level, is repo in the allow list?
Check context: secrets.X vs vars.X vs env.X?
Check forks: secrets are NOT available to fork PRs (by design)

Additional Resources

Reference Files

For full CLI examples, API details, and extended patterns:

references/scope-hierarchy.md — Complete CLI syntax for all scopes, Dependabot/Codespaces secrets, Doppler sync patterns, shadowing rules
references/common-mistakes.md — Detailed mistake catalog with wrong/correct examples, diagnostic checklist

---name: github-secretsdescription: This skill should be used when the user asks to "set a GitHub secret", "add a GitHub variable", "configure secrets for a workflow", "list GitHub secrets", "fix missing secrets in CI", "set up environment secrets", "add org secrets", "debug empty secret values in GitHub Actions", or any task involving GitHub Actions secrets, variables, or environment configuration. Also triggers when editing .github/workflows/ files that reference secrets.* or vars.* contexts.---# GitHub Secrets & VariablesGitHub secrets and variables exist at three scopes with strict precedence rules. Getting the scope wrong causes silent failures — empty values with no error.## Scope Hierarchy```Organization → Repository → Environment(broadest) (most specific, wins ties)```- **Organization**: shared across repos, set with `--org`- **Repository**: default scope, no flag needed inside a repo- **Environment**: requires `--env` flag AND `environment:` in the workflow jobEnvironment > Repository > Organization when names collide.## Secrets vs Variables — Quick Reference| | Secrets (`secrets.*`) | Variables (`vars.*`) ||---|---|---|| CLI | `gh secret` | `gh variable` || Workflow | `${{ secrets.NAME }}` | `${{ vars.NAME }}` || Encrypted | Yes | No || Readable after set | No (write-only) | Yes || Use for | Tokens, passwords, keys | URLs, flags, config |These are different namespaces. `secrets.X` and `vars.X` are not interchangeable.## Critical Rules### Always check before setting```bash# Secrets — can only check existence, not valuegh secret list [--org ORG] [--env ENV] | grep -q "^NAME"# Variables — can check existence AND valuegh variable list [--org ORG] [--env ENV] --json name,value```### Never try to read secret valuesThere is no `gh secret get`. Secrets are write-only. `gh secret list` shows names only. To update, re-set from the source of truth.### Environment secrets require `environment:` in the job```yamljobs: deploy: environment: production # WITHOUT THIS, environment secrets are invisible steps: - run: echo "${{ secrets.PROD_SECRET }}"```This is the single most common mistake. Missing `environment:` produces empty values with zero warnings.### Scope flags are required and specific```bashgh secret set X --body "v" # repo (default)gh secret set X --org my-org --body "v" # orggh secret set X --env production --body "v" # environment```Omitting `--org` or `--env` silently creates at the wrong scope.## Workflow Contexts — Do Not Confuse```yaml${{ secrets.NAME }} # GitHub-managed encrypted secrets${{ vars.NAME }} # GitHub-managed plaintext variables${{ env.NAME }} # Workflow-defined env vars (env: blocks)${{ github.token }} # Auto-generated GITHUB_TOKEN````env.X` is set in the workflow YAML with `env:` blocks. `secrets.X` and `vars.X` are set via `gh` CLI or the GitHub UI. These are completely separate systems.## Diagnostic WorkflowWhen a secret/variable appears missing in CI:1. Verify existence: `gh secret list` / `gh variable list` with correct scope flags2. Check scope: org vs repo vs environment3. Check job: does it declare `environment:` if using environment secrets?4. Check shadowing: same name at multiple scopes?5. Check org visibility: if org-level, is repo in the allow list?6. Check context: `secrets.X` vs `vars.X` vs `env.X`?7. Check forks: secrets are NOT available to fork PRs (by design)## Additional Resources### Reference FilesFor full CLI examples, API details, and extended patterns:- **`references/scope-hierarchy.md`** — Complete CLI syntax for all scopes, Dependabot/Codespaces secrets, Doppler sync patterns, shadowing rules- **`references/common-mistakes.md`** — Detailed mistake catalog with wrong/correct examples, diagnostic checklist

Frequently asked questions