GitHub Auth

What it does

When your agent uses it

• Tasks that involve Authentication
• Tasks that involve Git workflow

Example prompts

• “/github-auth”

Requirements

• A Bash shell
• A credential in THEIR_TOKEN
• A credential in GITHUB_TOKEN

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

1. 1If gh auth status shows authenticated → you're good, use gh for everything
2. 2If gh is installed but not authenticated → use "gh auth" method below
3. 3If gh is not installed → use "git-only" method below (no sudo needed)

What it can do on your machine

Read from SKILL.md and the folder at commit be46b39. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 1 file in scripts/ (Shell), which the agent can run.

  Shell commands in SKILL.md call:

  • git
  • gh
  • ssh
  • curl

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • github.com
  • api.github.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • GITHUB_TOKEN
  • THEIR_TOKEN

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

GitHub Auth loads about 1.9k tokens when it runs. Until then it costs about 58 tokens; SKILL.md has 554 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~58

When it runs · the whole SKILL.md, loaded when a task matches

~1.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteRuns commands with sudoSKILL.md:37

  talled → use "git-only" method below (no sudo needed)

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:117

  ls -la ~/.ssh/id_*.pub 2>/dev/null || echo "No SSH keys found"

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:124

  ed25519 -C "their-email@example.com" -f ~/.ssh/id_ed25519 -N ""

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:127

  cat ~/.ssh/id_ed25519.pub

• NoteMentions a .env fileSKILL.md:222

  elif [ -f ~/.hermes/.env ] && grep -q "^GITHUB_TOKEN=" ~/.hermes/.env; then

• NoteMentions a .env fileSKILL.md:223

  _TOKEN=$(grep "^GITHUB_TOKEN=" ~/.hermes/.env | head -1 | cut -d= -f2 | tr -d '\n\r')

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:243

  443` and `Hostname ssh.github.com` to `~/.ssh/config` |

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:245

  with different keys per host alias in `~/.ssh/config`, or per-repo credential URLs |

• NoteRuns commands with sudoSKILL.md:246

  | `gh: command not found` + no sudo | Use git-only Method 1 above — no installation needed |

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from RedWoodOG/Hermes-Desktop at commit be46b39, republished under its MIT licence (© RedWoodOG). 554 words, ~1,911 tokens.

name

github-auth

description

Set up GitHub authentication for the agent using git (universally available) or the gh CLI. Covers HTTPS tokens, SSH keys, credential helpers, and gh auth — with a detection flow to pick the right method automatically.

version

1.1.0

author

Hermes Agent

license

MIT

# Check what's available
git --version
gh --version 2>/dev/null || echo "gh not installed"

# Check if already authenticated
gh auth status 2>/dev/null || echo "gh not authenticated"
git config --global credential.helper 2>/dev/null || echo "no git credential helper"

# Set up the credential helper to cache credentials
# "store" saves to ~/.git-credentials in plaintext (simple, persistent)
git config --global credential.helper store

# Now do a test operation that triggers auth — git will prompt for credentials
# Username: <their-github-username>
# Password: <paste the personal access token, NOT their GitHub password>
git ls-remote https://github.com/<their-username>/<any-repo>.git

# Cache in memory for 8 hours (28800 seconds) instead of saving to disk
git config --global credential.helper 'cache --timeout=28800'

# Embed token in the remote URL (avoids credential prompts entirely)
git remote set-url origin https://<username>:<token>@github.com/<owner>/<repo>.git

# Required for commits — set name and email
git config --global user.name "Their Name"
git config --global user.email "their-email@example.com"

# Test push access (this should work without any prompts now)
git ls-remote https://github.com/<their-username>/<any-repo>.git

# Verify identity
git config --global user.name
git config --global user.email

ls -la ~/.ssh/id_*.pub 2>/dev/null || echo "No SSH keys found"

# Generate an ed25519 key (modern, secure, fast)
ssh-keygen -t ed25519 -C "their-email@example.com" -f ~/.ssh/id_ed25519 -N ""

# Display the public key for them to add to GitHub
cat ~/.ssh/id_ed25519.pub

ssh -T git@github.com
# Expected: "Hi <username>! You've successfully authenticated..."

# Rewrite HTTPS GitHub URLs to SSH automatically
git config --global url."git@github.com:".insteadOf "https://github.com/"

git config --global user.name "Their Name"
git config --global user.email "their-email@example.com"

gh auth login
# Select: GitHub.com
# Select: HTTPS
# Authenticate via browser

echo "<THEIR_TOKEN>" | gh auth login --with-token

# Set up git credentials through gh
gh auth setup-git

gh auth status

# Option 1: Export as env var (preferred — keeps it out of commands)
export GITHUB_TOKEN="<token>"

# Then use in curl calls:
curl -s -H "Authorization: token $GITHUB_TOKEN" \
  https://api.github.com/user

# Read from git credential store
grep "github.com" ~/.git-credentials 2>/dev/null | head -1 | sed 's|https://[^:]*:\([^@]*\)@.*|\1|'

# Try gh first, fall back to git + curl
if command -v gh &>/dev/null && gh auth status &>/dev/null; then
  echo "AUTH_METHOD=gh"
elif [ -n "$GITHUB_TOKEN" ]; then
  echo "AUTH_METHOD=curl"
elif [ -f ~/.hermes/.env ] && grep -q "^GITHUB_TOKEN=" ~/.hermes/.env; then
  export GITHUB_TOKEN=$(grep "^GITHUB_TOKEN=" ~/.hermes/.env | head -1 | cut -d= -f2 | tr -d '\n\r')
  echo "AUTH_METHOD=curl"
elif grep -q "github.com" ~/.git-credentials 2>/dev/null; then
  export GITHUB_TOKEN=$(grep "github.com" ~/.git-credentials | head -1 | sed 's|https://[^:]*:\([^@]*\)@.*|\1|')
  echo "AUTH_METHOD=curl"
else
  echo "AUTH_METHOD=none"
  echo "Need to set up authentication first"
fi

© RedWoodOG, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (scripts) in skills/github/github-auth of RedWoodOG/Hermes-Desktop.

• SKILL.md
• scripts/gh-env.sh

Open the folder on GitHubat commit be46b39

Used in 3 other repositories

We found 4 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 3 other GitHub owners. This page covers the copy in RedWoodOG/Hermes-Desktop, which our catalogue first saw on October 7, 2026.

• Tommy-yw/RunbookHermesskills/github/github-auth
• johnson7788/MultiUserClawhermes-agent/skills/github/github-auth
• ArgentAIOS/argentos-coreskills/hermes/github/github-authskills/community/github/github-auth