Use when the user wants to connect to GitHub, search or read issues / PRs / code, create or update issues and PRs, inspect Actions runs, or review Dependabot / code-scanning alerts. The connector — not security tradecraft.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# GitHub
Connector for GitHub via its official remote MCP server. The agent sees the
enabled tool surface (~58 tools) once the server loads — this skill covers what
the tool specs don't: auth, read-only scoping, the issue-search DSL, and the
non-obvious idioms. Security triage methodology — dedup, severity, SLA, owner
inference — is deliberately out of scope; pair this with whichever triage
capability your workflow uses.
## Auth
Token sent as a Bearer header — **no OAuth**. This is a GitHub-side limit: its
remote MCP server doesn't support Dynamic Client Registration and its OAuth web
flow needs a `client_secret` that can't ship in an installed tool, so OAuth is
reserved for GitHub's allowlisted first-party hosts (VS Code, Cursor, …). For this
connector, a token is the path.
**Already using the `gh` CLI? Reuse its session — no new token.**
```bash
gh auth token # copy the output into /secrets → GITHUB_PAT
```
Quickest path for most developers. `gh` OAuth tokens can rotate/expire, so for a
long-lived / unattended setup mint a fine-grained PAT instead:
1. <https://github.com/settings/personal-access-tokens/new>, scoped to the repos or
…
The line at the top of this page pins the label git:20260728.e04a3ae, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_b5ml5hwjpnl3nqbg
GET https://markdownregistry.com/api/v1/resolve?ref=dreadnode/capabilities/github
GET https://markdownregistry.com/api/v1/blob/c95f253fc799f84ba8a4bbb71b8ef35b969e643bfbea8b426a7007b59c6cfdce
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
dreadnode/capabilities · capabilities/ai-red-teaming/skills/analytics-interpretation/SKILL.md · Guide for reading and interpreting AIRT analytics output including ASR, risk scores, severity, and compliance metrics
dreadnode/capabilities · capabilities/ai-red-teaming/skills/attack-selection-guide/SKILL.md · Decision tree for selecting AIRT attacks based on goals, target type, and constraints
dreadnode/capabilities · capabilities/ai-red-teaming/skills/auth-setup-guide/SKILL.md · Guide the user through authenticating the target, attacker, and judge models from their own environment (any cloud, any…
dreadnode/capabilities · capabilities/ai-red-teaming/skills/compliance-mapping/SKILL.md · Maps AIRT attacks, transforms, and scorers to OWASP LLM Top 10, OWASP ASI (ASI01-ASI10), MITRE ATLAS, NIST AI RMF, and…
dreadnode/capabilities · capabilities/ai-red-teaming/skills/error-troubleshooting/SKILL.md · Diagnose and fix common errors in AIRT attack generation, execution, and results collection
dreadnode/capabilities · capabilities/ai-red-teaming/skills/provisioning-and-lifecycle/SKILL.md · Provision a hosted target, pick the right endpoint per target type, tear down to stop billing, and interpret transient…
dreadnode/capabilities · capabilities/ai-red-teaming/skills/transform-reference/SKILL.md · Catalog of AIRT transforms - 429 text transforms (596 incl. multimodal/variants); documents the core set with exact…
dreadnode/capabilities · capabilities/ai-red-teaming/skills/whitebox-local-surrogate/SKILL.md · How to run white-box (gradient/embedding/activation) attacks, which need a local open-weight surrogate model the user…
volcengine/openviking · bot/workspace/skills/github/SKILL.md · Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and…
phyagentos/phyagentos-core · PhyAgentOS/skills/github/SKILL.md · Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and…
bitterbot-ai/bitterbot-desktop · skills/github/SKILL.md · Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and…
dicklesworthstone/pi_agent_rust · tests/ext_conformance/artifacts/npm/mitsupi/skills/github/SKILL.md · Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and…
trpc-group/trpc-agent-go · openclaw/skills/github/SKILL.md · GitHub operations via `gh` CLI: issues, PRs, CI runs, code review, API queries. Use when: (1) checking PR status or CI…
team-commonly/commonly · backend/commonly-bundled-skills/github/SKILL.md · Interact with GitHub (issues, PRs, repos, releases) using the `gh` CLI. Use when asked to read or write GitHub state —…
kostja94/marketing-skills · skills/platforms/github/SKILL.md · When the user wants to use GitHub for SEO, parasite SEO, GEO, open source marketing, README optimization, or curated…
