SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsverasic-github-env

verasic-github-env

Deployment & operations

View repository

Updated 10-16 01:16

About this skill

Security: see references/scanner-notes.md and upstream SECURITY.md for expected scanner signals and trust model.

Verasic GitHub Env — Local Agent Harness Auth

Workflows

All paths below assume the Cursor install root; installed elsewhere (e.g. .agents/skills/), adjust the prefix — the scripts themselves are install-root-agnostic. /verasic-init runs the bootstrap for you.

Bootstrap path — wire a repo once:

  1. Read references/setup-protocol.md (in this skill's directory) for secrets tiers and PAT permissions.
  2. From the repo root: bash .cursor/skills/verasic-github-env/scripts/bootstrap.sh (or /verasic-setup-github in Cursor, or let /verasic-init do it).
  3. User creates .github-agent.local with GH_TOKEN (never commit).
  4. Verify: bash .cursor/skills/verasic-github-env/scripts/check-gh.sh

Runtime path — before any gh command:

  1. If GH_TOKEN is unset, load credentials without executing env files:
source .cursor/skills/verasic-github-env/scripts/load-gh-env.sh
  1. Use gh with -R "${GH_REPO}" when auto-detection fails.
  2. Never log or commit tokens. Do not run bare gh auth status in agent logs — use check-gh.sh.

Source of truth

The full spec lives in references/setup-protocol.md. The Cursor rule is a thin digest; never duplicate the spec elsewhere.

Hard rules

  • Local agents → .github-agent.local; CI → GitHub Actions; production → secrets manager — never mix tiers.
  • One fine-grained PAT per repo, scoped to that repo only.
  • Never use gh auth login device-flow polling loops for harness setup — use GH_TOKEN.