checkout-credential-review

What the skill teaches

A review skill for gh-aw contributors who touch code that runs git or gh commands against repository checkouts. It explains how each checkout entry in a workflow can carry its own token, why later steps do not inherit it automatically, and that the safe-outputs MCP server and the agent runtime run without git credentials on purpose. A checklist asks whether a command reaches a remote, which checkout and credential it uses, which job runs it, and whether it would deepen a sparse or shallow checkout.

Capabilities

Details