gh — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gh (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
gh has no command to list, reply to, or resolve PR review threads. Use the gh-arriba extension:
gh arriba pr threads {pr-number} --json # unresolved, current threads with their IDs
gh arriba pr reply {comment-id} "Fixed." --resolve
gh arriba pr resolve {thread-id}... # PRRT_ IDs or comment IDs, --undo to reopengh pr edit --add-reviewer can fail with cryptic empty-string errors. Use gh arriba, which calls the REST endpoint:
gh arriba pr reviewers {pr-number} --add usernamegh run rerun takes one workflow run at a time. Use gh arriba, which reruns the failed jobs of every run on a PR, or on all your open PRs when given owner/repo:
gh arriba pr retry {pr-number}gh pr update-branch --rebase rebases server-side, so the commits lose their signatures. Use gh arriba, which rebases locally with your signing key and pushes with a lease. Add --remote for the server-side rebase:
gh arriba pr rebase {pr-number}gh arriba comments @dependabot rebase on each PR, and prompts for which ones when given none:
gh arriba dependabot rebase {pr-number}... # or --allgh run view --log can be unreliable for large logs. Download job logs to files for searching. It takes a run ID, a job ID, or an Actions URL, and prints the path of each log:
gh arriba run logs {run-id} --repo {owner}/{repo} --failed -o /tmp/logsgh api repos/.../artifacts/{id}/zip > foo.zip can truncate large artifacts (≥1GB+) without erroring — the resulting file fails to unzip with "End-of-central-directory signature not found." Use gh run download instead, which streams the artifact correctly and unzips the outer wrapper for you:
gh run download {run-id} --repo {owner}/{repo} --name {artifact-name} --dir /tmp/outThe artifact's contents land directly in --dir (no outer .zip to unwrap). You still need to extract any inner .tar.gz/.zip payloads yourself.
gh-stackThe github/gh-stack extension (gh extension install github/gh-stack) manages a local stack of branches and the corresponding stack of PRs. A few non-obvious details:
If you already have a branch with work and an open PR, gh stack init without arguments errors out. Pass the branch name with -a/--adopt and the trunk with -b:
gh stack init -a --base dev nathan/dev/feature-oneThis registers the existing branch as the bottom of a new stack rooted at dev without creating any new commits or branches.
gh stack add nathan/dev/feature-twoCreates a new branch based on the current stack top and checks it out. You can then commit, and later gh stack submit --auto will push all branches in the stack and open PRs with the correct base chain (e.g. feature-two → feature-one → dev).
gh stack viewPrints an ASCII diagram of the stack with current branch, PR number, commit sha, and trunk. Much more useful than git log --graph for stack navigation.
gh stack down — check out the next branch toward trunk (parent in the stack).gh stack up — check out the next branch away from trunk (child in the stack).gh stack bottom / gh stack top — jump to the ends.gh stack submit --auto pushes every branch in the stack, creates or updates PRs on GitHub, and sets each PR's base to the branch below it. Safe to re-run after amending commits on any branch in the stack — it force-pushes the affected branches and leaves the untouched ones alone.
To re-sync without opening PRs:
gh stack pushgh stack submit does not stage or commit anything — stage and commit with git first, then submit.gh stack rebase (not git rebase) to propagate the new base through every layer.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.