New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Gh Auth Isolation

by FritzAndFriends in FritzAndFriends/SharpSite

Safely manage multiple GitHub identities (EMU + personal) in agent workflows

MITAuto-check: notes

Install Gh Auth Isolation

skills CLI
$ npx skills add FritzAndFriends/SharpSite --skill gh-auth-isolation -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install FritzAndFriends/SharpSite gh-auth-isolation --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/FritzAndFriends/SharpSite.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.copilot/skills/gh-auth-isolation .claude/skills/gh-auth-isolation && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
gh-auth-isolation
GitHub stars
145
Used in
2 other repos
Token cost
~1.6k tokens
SKILL.md length
413 words
Files
1
Skills in repo
18
Repo updated
First seen
Licence
MIT

At a glance

Safely manage multiple GitHub identities (EMU + personal) in agent workflows

  • SKILL.md covers Context, Patterns, Examples and Anti-Patterns
  • Calls gh and git; reaches github.com; needs GH_TOKEN

What it does

Gh Auth Isolation is an agent skill from FritzAndFriends/SharpSite. Safely manage multiple GitHub identities (EMU + personal) in agent workflows

Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It works with GitHub. The repository describes itself as: A basic CMS built with .NET 9 and Blazor. The licence is MIT.

Example prompts

  • “/gh-auth-isolation”

What it can do on your machine

Read from SKILL.md and the folder at commit c35e5e0. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • gh
    • git

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • GH_TOKEN

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Gh Auth Isolation loads about 1.6k tokens when it runs. Until then it costs about 24 tokens; SKILL.md has 413 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~24
When it runs · the whole SKILL.md, loaded when a task matches
~1.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:180
    - ❌ **Storing personal tokens in `.env`** or `.squad/` files. These get committed by Scribe. Use `gh`'s credential store

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from FritzAndFriends/SharpSite at commit c35e5e0, republished under its MIT licence (© FritzAndFriends). 413 words, ~1,603 tokens.

Download SKILL.mdSave it as .claude/skills/gh-auth-isolation/SKILL.md (or your agent's skills folder).
name
gh-auth-isolation
description
Safely manage multiple GitHub identities (EMU + personal) in agent workflows
domain
security, github-integration, authentication, multi-account
confidence
high
source
earned (production usage across 50+ sessions with EMU corp + personal GitHub accounts)

Context

Many developers use GitHub through an Enterprise Managed User (EMU) account at work while maintaining a personal GitHub account for open-source contributions. AI agents spawned by Squad inherit the shell's default gh authentication — which is usually the EMU account. This causes failures when agents try to push to personal repos, create PRs on forks, or interact with resources outside the enterprise org.

This skill teaches agents how to detect the active identity, switch contexts safely, and avoid mixing credentials across operations.

Patterns

Detect Current Identity

Before any GitHub operation, check which account is active:

bash
gh auth status

Look for:

  • Logged in to github.com as USERNAME — the active account
  • Token scopes: ... — what permissions are available
  • Multiple accounts will show separate entries
Extract a Specific Account's Token

When you need to operate as a specific user (not the default):

bash
# Get the personal account token (by username)
gh auth token --user personaluser

# Get the EMU account token
gh auth token --user corpalias_enterprise

Use case: Push to a personal fork while the default gh auth is the EMU account.

Push to Personal Repos from EMU Shell

The most common scenario: your shell defaults to the EMU account, but you need to push to a personal GitHub repo.

bash
# 1. Extract the personal token
$token = gh auth token --user personaluser

# 2. Push using token-authenticated HTTPS
git push https://personaluser:$token@github.com/personaluser/repo.git branch-name

Why this works: gh auth token --user reads from gh's credential store without switching the active account. The token is used inline for a single operation and never persisted.

Create PRs on Personal Forks

When the default gh context is EMU but you need to create a PR from a personal fork:

bash
# Option 1: Use --repo flag (works if token has access)
gh pr create --repo upstream/repo --head personaluser:branch --title "..." --body "..."

# Option 2: Temporarily set GH_TOKEN for one command
$env:GH_TOKEN = $(gh auth token --user personaluser)
gh pr create --repo upstream/repo --head personaluser:branch --title "..."
Remove-Item Env:\GH_TOKEN
Config Directory Isolation (Advanced)

For complete isolation between accounts, use separate gh config directories:

bash
# Personal account operations
$env:GH_CONFIG_DIR = "$HOME/.config/gh-public"
gh auth login  # Login with personal account (one-time setup)
gh repo clone personaluser/repo

# EMU account operations (default)
Remove-Item Env:\GH_CONFIG_DIR
gh auth status  # Back to EMU account

Setup (one-time):

bash
# Create isolated config for personal account
mkdir ~/.config/gh-public
$env:GH_CONFIG_DIR = "$HOME/.config/gh-public"
gh auth login --web --git-protocol https
Show full SKILL.md (166 more words)Show less
Shell Aliases for Quick Switching

Add to your shell profile for convenience:

powershell
# PowerShell profile
function ghp { $env:GH_CONFIG_DIR = "$HOME/.config/gh-public"; gh @args; Remove-Item Env:\GH_CONFIG_DIR }
function ghe { gh @args }  # Default EMU

# Usage:
# ghp repo clone personaluser/repo   # Uses personal account
# ghe issue list                       # Uses EMU account
bash
# Bash/Zsh profile
alias ghp='GH_CONFIG_DIR=~/.config/gh-public gh'
alias ghe='gh'

# Usage:
# ghp repo clone personaluser/repo
# ghe issue list

Examples

✓ Correct: Agent pushes blog post to personal GitHub Pages
powershell
# Agent needs to push to personaluser.github.io (personal repo)
# Default gh auth is corpalias_enterprise (EMU)

$token = gh auth token --user personaluser
git remote set-url origin https://personaluser:$token@github.com/personaluser/personaluser.github.io.git
git push origin main

# Clean up — don't leave token in remote URL
git remote set-url origin https://github.com/personaluser/personaluser.github.io.git
✓ Correct: Agent creates a PR from personal fork to upstream
powershell
# Fork: personaluser/squad, Upstream: bradygaster/squad
# Agent is on branch contrib/fix-docs in the fork clone

git push origin contrib/fix-docs  # Pushes to fork (may need token auth)

# Create PR targeting upstream
gh pr create --repo bradygaster/squad --head personaluser:contrib/fix-docs `
  --title "docs: fix installation guide" `
  --body "Fixes #123"
✗ Incorrect: Blindly pushing with wrong account
bash
# BAD: Agent assumes default gh auth works for personal repos
git push origin main
# ERROR: Permission denied — EMU account has no access to personal repo

# BAD: Hardcoding tokens in scripts
git push https://personaluser:ghp_xxxxxxxxxxxx@github.com/personaluser/repo.git main
# SECURITY RISK: Token exposed in command history and process list
✓ Correct: Check before you push
bash
# Always verify which account has access before operations
gh auth status
# If wrong account, use token extraction:
$token = gh auth token --user personaluser
git push https://personaluser:$token@github.com/personaluser/repo.git main

Anti-Patterns

  • ❌ Hardcoding tokens in scripts, environment variables, or committed files. Use gh auth token --user to extract at runtime.
  • ❌ Assuming the default gh auth works for all repos. EMU accounts can't access personal repos and vice versa.
  • ❌ Switching gh auth login globally mid-session. This changes the default for ALL processes and can break parallel agents.
  • ❌ Storing personal tokens in .env or .squad/ files. These get committed by Scribe. Use gh's credential store.
  • ❌ Ignoring token cleanup after inline HTTPS pushes. Always reset the remote URL to avoid persisting tokens.
  • ❌ Using gh auth switch in multi-agent sessions. One agent switching affects all others sharing the shell.
  • ❌ Mixing EMU and personal operations in the same git clone. Use separate clones or explicit remote URLs per operation.

© FritzAndFriends, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .copilot/skills/gh-auth-isolation of FritzAndFriends/SharpSite.

Open the folder on GitHubat commit c35e5e0

Used in 2 other repositories

We found 2 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 2 other GitHub owners. This page covers the copy in FritzAndFriends/SharpSite, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Gh Auth Isolation next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Gh Auth Isolation compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Gh Auth Isolation this skillFritzAndFriends/SharpSite1452 repos~1.6kAutomated safety check: NotesMIT
PR Babysitteropeninterpreter/openinterpreter69k3 repos~4.2kAutomated safety check: PassApache-2.0
Greplooponyx-dot-app/onyx32k4 repos~3.3kAutomated safety check: PassMIT
GitHub Deep Researchbytedance/deer-flow84k4 repos~1.3kAutomated safety check: PassMIT
Diagnosing Superpowers Sessionsobra/superpowers297k3 repos~1.7kAutomated safety check: PassMIT
Update V8 Versionopeninterpreter/openinterpreter69k2 repos~845Automated safety check: PassApache-2.0

Similar skills

  • PR Babysitter

    openinterpreter/openinterpreter

    Watches an open GitHub pull request until it merges, handling review comments, diagnosing CI failures and retrying flaky checks along the way.

    69k GitHub starsUsed in 3 repos~4.2k tokens
    DevelopmentAuto-check passed

  • Greploop

    onyx-dot-app/onyx

    Iteratively improves a PR (GitHub), MR (GitLab), or shelved changelist (Perforce) until Greptile gives it a 5/5 confidence score with zero unresolved comments.

    32k GitHub starsUsed in 4 repos~3.3k tokens
    DevelopmentAuto-check passed

  • GitHub Deep Research

    bytedance/deer-flow

    Researches a GitHub repository over four rounds using the GitHub API and web search, then writes a structured markdown report with timeline, metrics and Mermaid diagrams.

    84k GitHub starsUsed in 4 repos~1.3k tokens
    Research & ScienceAuto-check passed

  • Diagnosing Superpowers Sessions

    obra/superpowers

    Investigates a session where Superpowers went wrong, reads the transcripts on disk and produces an evidence-cited report, optionally prepared as a bug report for the maintainers.

    297k GitHub starsUsed in 3 repos~1.7k tokens
    Agent WorkflowsAuto-check passed

  • Update V8 Version

    openinterpreter/openinterpreter

    Bumps the pinned v8 and rusty_v8 versions in Codex, validates the release-candidate path with the v8-canary check, and traces failures to upstream build changes.

    69k GitHub starsUsed in 2 repos~845 tokens
    DevOps & CloudAuto-check passed

  • Last30days

    mvanhorn/last30days-skill

    Research what people actually say about any topic in the last 30 days.

    64k GitHub stars~7.9k tokensUpdated today
    Research & ScienceAuto-check: notes

More from FritzAndFriends/SharpSite

All 18 skills in this repo

  • Architectural Proposals

    FritzAndFriends/SharpSite

    How to write comprehensive architectural proposals that drive alignment before code is written

    145 GitHub starsUsed in 2 repos~1.6k tokens
    Auto-check passed

  • Client Compatibility

    FritzAndFriends/SharpSite

    Platform detection and adaptive spawning for CLI vs VS Code vs other surfaces

    145 GitHub starsUsed in 2 repos~1.3k tokens
    Auto-check passed

  • Distributed Mesh

    FritzAndFriends/SharpSite

    How to coordinate with squads on different machines using git as transport

    145 GitHub starsUsed in 2 repos~3.1k tokens
    Auto-check passed

  • Docs Standards

    FritzAndFriends/SharpSite

    Microsoft Style Guide + Squad-specific documentation patterns

    145 GitHub starsUsed in 2 repos~567 tokens
    Auto-check passed

  • Economy Mode

    FritzAndFriends/SharpSite

    Shifts Layer 3 model selection to cost-optimized alternatives when economy mode is active.

    145 GitHub starsUsed in 2 repos~1.3k tokens
    Auto-check passed

  • External Comms

    FritzAndFriends/SharpSite

    PAO workflow for scanning, drafting, and presenting community responses with human review gate

    145 GitHub starsUsed in 2 repos~3.1k tokens
    Auto-check passed

Works with

Questions about Gh Auth Isolation

What does Gh Auth Isolation do?

Safely manage multiple GitHub identities (EMU + personal) in agent workflows. Gh Auth Isolation is an agent skill from FritzAndFriends/SharpSite.

How do I install Gh Auth Isolation in Claude Code?

Run `npx skills add FritzAndFriends/SharpSite --skill gh-auth-isolation -a claude-code`. Or copy the skill folder (.copilot/skills/gh-auth-isolation in FritzAndFriends/SharpSite) into .claude/skills/gh-auth-isolation in your project. Claude Code loads it when a task matches its description.

How do I install Gh Auth Isolation in Codex?

Run `npx skills add FritzAndFriends/SharpSite --skill gh-auth-isolation -a codex`. Or copy the skill folder (.copilot/skills/gh-auth-isolation in FritzAndFriends/SharpSite) into .agents/skills/gh-auth-isolation in your project. Codex loads it when a task matches its description.

Can I use Gh Auth Isolation in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add FritzAndFriends/SharpSite --skill gh-auth-isolation -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/gh-auth-isolation, .gemini/skills/gh-auth-isolation, .github/skills/gh-auth-isolation and .opencode/skills/gh-auth-isolation in your project.

What does Gh Auth Isolation need to run?

Going by SKILL.md and its folder, Gh Auth Isolation needs the command-line tools its instructions call (gh and git) and credentials named GH_TOKEN.

Does Gh Auth Isolation access the network?

SKILL.md names 1 domain. In commands or code: github.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.

Is Gh Auth Isolation safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Gh Auth Isolation use?

Gh Auth Isolation is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Gh Auth Isolation use?

About 1.6k tokens (SKILL.md is roughly 6.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Gh Auth Isolation?

Skills that share tags, products or a category with Gh Auth Isolation: PR Babysitter (openinterpreter/openinterpreter, 69k stars), Greploop (onyx-dot-app/onyx, 32k stars), GitHub Deep Research (bytedance/deer-flow, 84k stars) and Diagnosing Superpowers Sessions (obra/superpowers, 297k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Gh Auth Isolation?

FritzAndFriends (a GitHub organization) maintains it in FritzAndFriends/SharpSite, which has 145 GitHub stars. The repository holds 18 skills in this directory. The repository was last updated on April 30, 2026.

Source: FritzAndFriends/SharpSite on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.