New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Official agent skill

Checkout Credential Review

by github in github/gh-aw

Review code that performs git or gh operations against repository checkouts in gh-aw, checking that the right credentials are available at the right time and that sparseness, shallowness and…

OfficialMITAuto-check passedDevelopment

Install Checkout Credential Review

skills CLI
$ npx skills add github/gh-aw --skill checkout-credential-review -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install github/gh-aw checkout-credential-review --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/github/gh-aw.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.github/skills/checkout-credential-review .claude/skills/checkout-credential-review && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
checkout-credential-review
GitHub stars
5.3k
Token cost
~1.1k tokens
SKILL.md length
468 words
Files
1
Skills in repo
52
Repo updated
First seen
Licence
MIT

At a glance

Review code that performs git or gh operations against repository checkouts in gh-aw, checking that the right credentials are available at the right time and that sparseness, shallowness and…

  • Works in 5 steps: Does it touch a remote? Local-only… → Which checkout is it operating on? If… → Which job/context emits it? Agent job… → …
  • Tasks that involve Code review
  • SKILL.md covers Background, Review checklist and Related
  • Calls git and gh; needs GITHUB_TOKEN and GH_TOKEN

What it does

Checkout Credential Review is an agent skill from github/gh-aw, published by the product's own GitHub organization. Review code that performs git or gh operations against repository checkouts in gh-aw, checking that the right credentials are available at the right time and that sparseness, shallowness and credential-free factors are properly considered.

Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Development, covering Code review and Git workflow. It works with Git and GitHub. The repository describes itself as: GitHub Agentic Workflows. The licence is MIT.

When your agent uses it

  • Tasks that involve Code review
  • Tasks that involve Git workflow

Example prompts

  • “/checkout-credential-review”

Requirements

  • A credential in GITHUB_TOKEN

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Does it touch a remote? Local-only commands (symbolic-ref, rev-parse, log, show, merge-base, diff, status) need no credentials. Anything…
  2. Which checkout is it operating on? If it's a cross-repo entry from checkout:, the relevant credential is that entry's github-token, not…
  3. Which job/context emits it? Agent job and safe-outputs MCP server both run without git credentials by design. Any remote git operation…
  4. Sparse / shallow / monorepo concerns. Avoid emitting steps that deepen (git fetch --unshallow, --deepen=N) or widen (git fetch origin…
  5. gh is REST, not git. gh api … uses whatever GH_TOKEN is in the step's env — it does not automatically inherit per-checkout PATs. For…

What it can do on your machine

Read from SKILL.md and the folder at commit eb63040. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • git
    • gh

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use git and gh, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • GITHUB_TOKEN
    • GH_TOKEN

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Checkout Credential Review loads about 1.1k tokens when it runs. Until then it costs about 67 tokens; SKILL.md has 468 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~67
When it runs · the whole SKILL.md, loaded when a task matches
~1.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from github/gh-aw at commit eb63040, republished under its MIT licence (© github). 468 words, ~1,061 tokens.

Download SKILL.mdSave it as .claude/skills/checkout-credential-review/SKILL.md (or your agent's skills folder).
name
checkout-credential-review
description
Review code that performs git or gh operations against repository checkouts in gh-aw, checking that the right credentials are available at the right time and that sparseness, shallowness and credential-free factors are properly considered.

Checkout Credential Review

Use this skill when reviewing or writing code in pkg/workflow/, actions/setup/js/, or compiled .lock.yml workflows that runs git, gh, or any other remote-touching operation against a repository checkout.

Background

Each entry in a workflow's checkout: block may declare its own credentials (github-token:, github-app:), and the compiler wires those into the corresponding actions/checkout step (pkg/workflow/checkout_step_generator.go). Generated checkouts always set persist-credentials: false, so the on-disk repo retains no credentials after the step finishes — only actions/checkout's own internal token is used during the clone, and it is scrubbed in its post-step.

A separate step that wants to authenticate later must either (a) re-inject a token at command level (e.g. git -c http.extraheader=...) or (b) be passed the per-checkout token via env. The compiler does not automatically thread per-checkout github-tokens into downstream steps.

Two important contexts deliberately run with no git credentials:

  • The safe-outputs MCP server and its handlers (generate_git_bundle.cjs, generate_git_patch.cjs, create_pull_request.cjs). Errors in these paths explicitly say "the safe-outputs MCP server has no credentials for private repositories" — fetch/push will fail for private repos.
  • The agent runtime after actions/checkout. The agent prompt in actions/setup/md/safe_outputs_push_to_pr_branch.md explicitly tells the model not to attempt git fetch, git pull, git push, or any other authenticated git operation, and to report unavailable branches rather than try to fetch them.
Show full SKILL.md (255 more words)Show less

Review checklist

When you see a new git, gh, execFileSync('git'…), or compiled run: block:

  1. Does it touch a remote? Local-only commands (symbolic-ref, rev-parse, log, show, merge-base, diff, status) need no credentials. Anything in fetch | pull | push | clone | ls-remote | remote (set-url|add|update) does, plus on-demand blob fetches in partial clones.
  2. Which checkout is it operating on? If it's a cross-repo entry from checkout:, the relevant credential is that entry's github-token, not the workflow's default GITHUB_TOKEN. Confirm the per-entry token is actually threaded into the step's env (or refuse to do remote operations and degrade gracefully).
  3. Which job/context emits it? Agent job and safe-outputs MCP server both run without git credentials by design. Any remote git operation there must be wrapped in try/catch, fail soft, and surface a clear "no credentials" error rather than a raw git stderr.
  4. Sparse / shallow / monorepo concerns. Avoid emitting steps that deepen (git fetch --unshallow, --deepen=N) or widen (git fetch origin '+refs/heads/*') a sparse or shallow checkout of a large monorepo — these need credentials and can pull hundreds of MB. Prefer expanding fetch: / fetch-depth: / sparse-checkout: at compile time so it happens during actions/checkout with its internal token, never later.
  5. gh is REST, not git. gh api … uses whatever GH_TOKEN is in the step's env — it does not automatically inherit per-checkout PATs. For cross-org private repos, either thread the right token in or accept the call will 404 and handle it.

© github, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .github/skills/checkout-credential-review of github/gh-aw.

Open the folder on GitHubat commit eb63040

Compare with similar skills

Checkout Credential Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Checkout Credential Review compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Checkout Credential Review this skillgithub/gh-aw5.3k—~1.1kAutomated safety check: PassMIT
Address PR Feedback for ruby-gitruby-git/ruby-git1.8k—~657Automated safety check: PassMIT
PR Review Triagestickerdaniel/linkedin-mcp-server3.8k—~1.4kAutomated safety check: PassApache-2.0
GitHub Code ReviewRedWoodOG/Hermes-Desktop1775 repos~3.4kAutomated safety check: NotesMIT
Contributor-First PR MergeHKUDS/OpenHarness16k1 repos~847Automated safety check: PassMIT
Create Pull Requestcline/cline70k1 repos~1.6kAutomated safety check: PassApache-2.0

Similar skills

  • Address PR Feedback for ruby-git

    ruby-git/ruby-git

    Addresses unresolved pull request review threads and suppressed (low-confidence) Copilot review comments on the current branch, folds each fix into the…

    1.8k GitHub stars~657 tokensUpdated 5 days ago
    DevelopmentAuto-check passed

  • PR Review Triage

    stickerdaniel/linkedin-mcp-server

    Collects every review comment on a pull request, checks each against the real code, fixes the valid ones, pushes, and replies on and resolves each thread.

    3.8k GitHub stars~1.4k tokensUpdated today
    DevelopmentAuto-check passed

  • GitHub Code Review

    RedWoodOG/Hermes-Desktop

    Review code changes by analyzing git diffs, leaving inline comments on PRs, and performing thorough pre-push review.

    177 GitHub starsUsed in 5 repos~3.4k tokens
    DevelopmentAuto-check: notes

  • Contributor-First PR Merge

    HKUDS/OpenHarness

    Merges external GitHub pull requests while keeping the original author credited, and fixes conflicts after the merge instead of rewriting the contribution.

    16k GitHub starsUsed in 1 repo~847 tokens
    DevelopmentAuto-check passed

  • Create Pull Request

    cline/cline

    Opens a GitHub pull request from your current branch with the gh CLI, after reviewing the commits and diff and gathering the details the PR needs.

    70k GitHub starsUsed in 1 repo~1.6k tokens
    DevelopmentAuto-check passed

  • PR Review State Fetch

    prisma/orm

    Official

    Fetches a pull request's canonical review state as JSON, validates it, and renders markdown, a text summary and triage target files from it using bundled scripts.

    48k GitHub stars~767 tokensUpdated today
    DevelopmentAuto-check passed

More from github/gh-aw

All 52 skills in this repo

  • playwright-cli Browser Automation

    github/gh-aw

    Official

    Drives a real browser from the command line with playwright-cli to open pages, interact, mock requests, save state and work with Playwright tests.

    5.3k GitHub starsUsed in 23 repos~2.8k tokens
    Auto-check passed

  • Operational Value Designer

    github/gh-aw

    Official

    Designs and verifies a deterministic grader that measures whether a GitHub Agentic Workflow run reached its real-world or repository outcome.

    5.3k GitHub stars~6.8k tokensUpdated today
    Auto-check passed

  • Copilot Canvas Extension Author

    github/gh-aw

    Official

    Scaffolds, edits, reloads and debugs a canvas extension that the GitHub Copilot CLI can open in its side panel.

    5.3k GitHub stars~3.7k tokensUpdated today
    Auto-check passed

  • GitHub Copilot PR Finisher

    github/gh-aw

    Official

    Drives an open pull request to merge-ready from inside a GitHub Copilot cloud agent, resolving review threads and local checks concurrently, without merging or retriggering CI.

    5.3k GitHub stars~3.8k tokensUpdated today
    Auto-check: warnings

  • gh-aw Firewall Release Integrator

    github/gh-aw

    Official

    Bumps gh-aw's pinned gh-aw-firewall version, rebuilds generated artifacts, and flags upstream spec or schema changes that need follow-up work.

    5.3k GitHub stars~899 tokensUpdated today
    Auto-check passed

  • gh-aw Console Rendering Tags

    github/gh-aw

    Official

    Guide to the console struct tag system in gh-aw: headers, titles, number and cost formats, omitempty, and how structs, slices and maps render in the terminal.

    5.3k GitHub stars~736 tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about Checkout Credential Review

What does Checkout Credential Review do?

Review code that performs git or gh operations against repository checkouts in gh-aw, checking that the right credentials are available at the right time and that sparseness, shallowness and…. Checkout Credential Review is an agent skill from github/gh-aw, published by the product's own GitHub organization. Review code that performs git or gh operations against repository checkouts in gh-aw, checking that the right credentials are available at the right time and that sparseness, shallowness and credential-free factors are properly considered.

When should I use Checkout Credential Review?

Checkout Credential Review fits situations like: tasks that involve Code review; tasks that involve Git workflow.

How do I install Checkout Credential Review in Claude Code?

Run `npx skills add github/gh-aw --skill checkout-credential-review -a claude-code`. Or copy the skill folder (.github/skills/checkout-credential-review in github/gh-aw) into .claude/skills/checkout-credential-review in your project. Claude Code loads it when a task matches its description.

How do I install Checkout Credential Review in Codex?

Run `npx skills add github/gh-aw --skill checkout-credential-review -a codex`. Or copy the skill folder (.github/skills/checkout-credential-review in github/gh-aw) into .agents/skills/checkout-credential-review in your project. Codex loads it when a task matches its description.

Can I use Checkout Credential Review in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add github/gh-aw --skill checkout-credential-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/checkout-credential-review, .gemini/skills/checkout-credential-review, .github/skills/checkout-credential-review and .opencode/skills/checkout-credential-review in your project.

What does Checkout Credential Review need to run?

Going by SKILL.md and its folder, Checkout Credential Review needs the command-line tools its instructions call (git and gh) and credentials named GITHUB_TOKEN and GH_TOKEN. Our summary lists: A credential in GITHUB_TOKEN.

Does Checkout Credential Review access the network?

SKILL.md contains no URLs. Its commands use git and gh, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Checkout Credential Review safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Checkout Credential Review use?

Checkout Credential Review is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Checkout Credential Review use?

About 1.1k tokens (SKILL.md is roughly 4.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Checkout Credential Review?

Skills that share tags, products or a category with Checkout Credential Review: Address PR Feedback for ruby-git (ruby-git/ruby-git, 1.8k stars), PR Review Triage (stickerdaniel/linkedin-mcp-server, 3.8k stars), GitHub Code Review (RedWoodOG/Hermes-Desktop, 177 stars) and Contributor-First PR Merge (HKUDS/OpenHarness, 16k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Checkout Credential Review?

github (a GitHub organization, an official publisher) maintains it in github/gh-aw, which has 5,350 GitHub stars. The repository holds 52 skills in this directory. The repository was last updated on October 7, 2026.

Source: github/gh-aw on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.