---
title: "gh CLI - Air Market"
description: "You point at something on GitHub and get a wall of nothing, because the request went out logged out. This keeps GitHub work going through the signed-in gh command line tool instead of plain web fetch…"
canonical: "https://airmarket.ai/app/gh-cli"
---

[Air Market](/) / [Developer Tools](/category/devtools) / gh CLI

Skill by [Trail of Bits](/@trailofbits)

# gh CLI

Talk to GitHub as yourself instead of as an anonymous fetch

## What this does

You point at something on GitHub and get a wall of nothing, because the request went out logged out. This keeps GitHub work going through the signed-in gh command line tool instead of plain web fetches, so private and rate-limited things come back. Reach for it whenever the work touches a GitHub link, an issue, or a pull request.

### Top 3 things it does for you

- Open a GitHub URL with your own credentials
- Pull up a pull request or an issue
- Reach the GitHub API without guessing at raw requests

## Information

**gh CLI at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [Trail of Bits](/@trailofbits) |
| Category | [Developer Tools](/category/devtools) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Size | 4 KB |
| Licence | CC-BY-SA-4.0 |
| Repository | [trailofbits/skills](https://github.com/trailofbits/skills/tree/d5fe2e6a7896236c3102fd5477e833623ad70298/plugins/gh-cli/skills/gh-cli) |
| GitHub stars | 6,823 (as of Nov 2026) |
| Installs | 7,090, counted by skills.sh (Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of gh CLI and flagged nothing. AIR's verdict: **safe**.

**What gh CLI's check was run against**

|  |  |
| --- | --- |
| Commit | d5fe2e6a7896236c3102fd5477e833623ad70298 |
| Content hash | 5379e627e79c902763d555d2b336232dee6b5d0ae77b57d654f02c1624794586 |
| Files read | [Browse the files at this exact commit](https://github.com/trailofbits/skills/blob/d5fe2e6a7896236c3102fd5477e833623ad70298/plugins/gh-cli/skills/gh-cli/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for gh CLI](/security/gh-cli)

## About gh CLI

GitHub work has two ways to happen: authenticated through the gh command line tool, or unauthenticated through a plain curl or web fetch. This skill pushes the work onto the first path and away from the second.

It applies whenever the task touches a GitHub URL, the GitHub API, a pull request, or an issue.

## What's inside

- SKILL.md - instructions
- agents/openai.yaml - data
- assets/trail-of-bits-mark.svg - template

## Questions

### Is gh CLI safe to install?

AIR scanned this exact version of gh CLI and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit d5fe2e6a7896, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/gh-cli.

### How do I install gh CLI?

Open https://airmarket.ai/app/gh-cli on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/trailofbits/skills/tree/d5fe2e6a7896236c3102fd5477e833623ad70298/plugins/gh-cli/skills/gh-cli. Install from that link, not the branch.

## Related on Air Market

- [More Developer Tools listings](/category/devtools)
- [Everything by Trail of Bits](/@trailofbits)

---

Canonical URL: <https://airmarket.ai/app/gh-cli>