메뉴
Create least-privilege fine-grained GitHub personal access tokens. Use when the user wants a PAT template, recurring machine credential, private-repository token, or GitHub token rotation.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | github-fine-grained-pat |
| description | Create least-privilege fine-grained GitHub personal access tokens. Use when the user wants a PAT template, recurring machine credential, private-repository token, or GitHub token rotation. |
Create a narrowly scoped token and keep its value out of chat, logs, command arguments, and version control.
Confirm or infer:
Default machine-read grant:
contents=read;Do not grant all repositories or write access unless the task requires it.
Build this URL with percent-encoded values:
https://github.com/settings/personal-access-tokens/new?name=<name>&description=<description>&target_name=<owner>&expires_in=<days>&contents=read
Supported template fields are name, description, target_name, expires_in, and permission names. Repository selection cannot be prefilled. Say this explicitly, then list the repositories the user must select under Only select repositories.
Use GitHub's current permission parameter names. If the requested grant is broader than contents=read, verify the parameter in GitHub's official token documentation before constructing the link.
If the user asks only for a link, stop after returning the link and repository checklist.
If the user asks the agent to create the token, use an authenticated browser session. Review the visible owner, repositories, expiration, and permissions immediately before generation. Creating the token is the requested external side effect; do not broaden its scope.
If authentication, reauthentication, CAPTCHA, or repository selection requires the user, leave the exact page open as a handoff and state the remaining action.
The token is shown once. Never print it, paste it into chat, or expose it in tool output.
When storage is in scope, save it directly into the requested secret manager. Prefer a dedicated item whose title identifies the machine and purpose. Record these non-secret fields beside it:
Do not place the token in flake.nix, committed nix.conf, shell history, or a Nix store path.
Verify without displaying the token:
Report scope and verification only, never the credential.
Fork one isolated Codex worktree thread per Beads issue and start each with a dependency-aware completion contract. Use when the user asks to start, fork, split, parallelize, or create separate chats for beads, tickets, issues, or a backlog with the goal of fixing them all.
This skill should be used when the user asks to "bump a package", "update an upstream revision", "refresh a Nix source hash", "rebase local patches", "carry fork changes as patches", "hack on upstream software in this repo", or fix a package whose patches no longer apply.
Jujutsu version control through jut, a human and agentic framework around jj. Use for: check status, view changes, commit work, create branches, push, pull, create PRs, squash commits, reword messages, absorb changes, undo operations, view history. Complements jj — use jut for opinionated workflows, drop into raw jj for everything else.
Create, manage, and verify healthchecks.io monitors via the REST API. Use when adding monitoring to a new cron job or service, auditing existing checks, wiring ping URLs into configs, or verifying a check fired correctly.
Control live Herdr workspaces, tabs, panes, agents, worktrees, layouts, plugins, and waits. Use when running inside Herdr (`HERDR_ENV=1`) to inspect sibling agents, delegate work—including dedicated Pi workspaces—run services, debug agent detection, or coordinate terminal state.
Structural code search, refactoring, and repository lint-rule setup with ast-grep. Use when searching by syntax shape, writing or testing ast-grep rules, configuring sgconfig.yml, enforcing coding standards, selecting rule severity, or adding ast-grep to project checks and CI.