Use the bundled script so authentication, repository resolution, MIME detection, and URL extraction remain consistent.
Requirements
- Require the
ghCLI andcurl. - Prefer an existing
gh auth loginsession. - When interactive
ghauthentication is unavailable, requireGH_TOKENorGITHUB_TOKENin the environment. - Stop and ask the user to configure one of those authentication methods if
gh auth tokencannot resolve a token. Never print, persist, or interpolate the token into diagnostic output.
Upload
<skill-dir> is the directory that contains this SKILL.md. Run from a checkout of the destination repository:
<skill-dir>/scripts/upload-github-attachment.sh /absolute/path/to/image.png
Specify the repository when the current directory cannot resolve it:
<skill-dir>/scripts/upload-github-attachment.sh \
--repo OWNER/REPO \
/absolute/path/to/image.png
The script prints only the final https://github.com/user-attachments/assets/... URL. Embed it with  for an image or [label](URL) for another file.
Verification
- Require a successful upload command and a returned
https://github.com/user-attachments/assets/...URL. - Use that URL for the intended local file. Do not issue GET or HEAD requests to verify the uploaded asset.
- Do not treat anonymous access returning 404 as an upload failure or a reason to stop the workflow.
- After creating or editing GitHub content, reopen it and verify the attachment Markdown uses the returned URL.
The upload endpoint is currently undocumented by GitHub. Treat a rejected upload request as a blocking capability change instead of committing PR-only artifacts. Background and the observed Bearer-token flow: https://island94.org/2026/08/programmatically-upload-attachments-to-github-issues-pull-requests-comments.