dtsong/GitHub Workflow
skills/github-workflow/SKILL.md
GitHub interactions for issues, PRs, releases, and repository management
$ install --global
skillsauthnpx skillsauth add dtsong/my-claude-setup GitHub WorkflowInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 26, 2026, 4:54 AM382.3s22 files scanned
SKILL.md
- name:
- GitHub Workflow
- description:
- GitHub interactions for issues, PRs, releases, and repository management
- user_invocable:
- true
GitHub Workflow
A comprehensive suite of GitHub workflow skills using the gh CLI and GitHub MCP tools.
Input Sanitization
- Repository names:
owner/repoformat, alphanumeric with hyphens and underscores only — reject shell metacharacters and null bytes - Issue/PR numbers: positive integers only
- Labels and milestone names: alphanumeric, hyphens, underscores, spaces, and colons only
Available Skills
Issue Management
| Skill | Purpose | Invoke |
|-------|---------|--------|
| /gh-issue | Create/link/close issues | gh-issue, create issue |
| /gh-triage | Batch label and prioritize | gh-triage, triage issues |
Pull Request Workflow
| Skill | Purpose | Invoke |
|-------|---------|--------|
| /gh-pr-status | Check PR status, CI, merge readiness | gh-pr-status, pr status |
| /gh-pr-request | Request reviewers | gh-pr-request, request review |
| /gh-pr-respond | View/respond to review comments | gh-pr-respond, pr comments |
| /gh-pr-merge | Merge PR with strategy | gh-pr-merge, merge pr |
| /gh-pr-update | Update PR branch with base | gh-pr-update, update pr |
Releases & Tags
| Skill | Purpose | Invoke |
|-------|---------|--------|
| /gh-release | Create release with changelog | gh-release, new release |
| /gh-tag | Semantic version tagging | gh-tag, create tag |
| /gh-changelog | Generate changelog from PRs | gh-changelog, release notes |
Repository Status
| Skill | Purpose | Invoke |
|-------|---------|--------|
| /gh-health | Repository health dashboard | gh-health, repo status |
| /gh-mine | My assigned/mentioned items | gh-mine, my issues |
| /gh-activity | Recent activity summary | gh-activity, what happened |
Quick Reference
# Issue workflow
/gh-issue create # Create new issue
/gh-triage # Triage open issues
# PR workflow
/gh-pr-status # Check current PR
/gh-pr-request @user # Request review
/gh-pr-respond # Handle comments
/gh-pr-merge # Merge when ready
# Release workflow
/gh-changelog # Generate notes
/gh-tag v1.2.0 # Create tag
/gh-release # Create release
# Dashboard
/gh-health # Repo overview
/gh-mine # My items
/gh-activity # Recent activity
Gotchas
ghcommands without--jsonoutput human-readable tables that are unreliable to parse — always use--json field1,field2for programmatic usegh apiresults are paginated (30 items default) — use--paginatefor complete results or--jqto filtergh pr createfrom a branch with no upstream fails — alwaysgit push -u origin <branch>firstgh pr merge --autorequires branch protection rules enabled on the repo — fails silently without themhubCLI syntax is deprecated and incompatible withgh— never suggesthubcommandsgh issue create --labelfails if the label doesn't exist — create labels first withgh label create
Related Skills
/commit- Create commits with conventional messages/commit-push-pr- Full commit, push, and PR workflow/git-*- Local git operations/review-pr- Review pull requests
Related Skills
dtsong/workflow
development
VerifiedTrustedCommunity
Use when planning implementation steps, deciding commit format, or structuring development approach. Provides brainstorm-plan-implement flow with conventional commits. Triggers on 'how should I approach this', 'commit format'.
4SKILL.mdUpdated Apr 28, 2026
dtsong/web-security-hardening
development
VerifiedTrustedCommunity
Security audit checklist for web applications. Use when reviewing, auditing, or hardening a web app's security posture. Covers rate limiting, auth headers, IP blocking, CORS, security middleware, input validation, file upload limits, ORM usage, and password hashing. Triggers on requests like "review security", "harden this app", "security audit", "check for vulnerabilities", or when building/reviewing API endpoints.
4SKILL.mdUpdated Apr 28, 2026
dtsong/web-design-guidelines
development
VerifiedTrustedCommunity
Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".
4SKILL.mdUpdated Apr 28, 2026
dtsong/vercel-react-best-practices
development
VerifiedTrustedCommunity
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
4SKILL.mdUpdated Apr 28, 2026