v2.90.0

Manage agent skills with gh skill (Public Preview)

Agent skills are portable sets of instructions, scripts, and resources that teach AI coding agents how to perform specific tasks. The new gh skill command makes it easy to discover, install, manage, and publish agent skills from GitHub repositories - right from the CLI.

# Discover skills
gh skill search copilot

# Preview a skill without installing
gh skill preview github/awesome-copilot documentation-writer

# Install a skill
gh skill install github/awesome-copilot documentation-writer

# Pin to a specific version
gh skill install github/awesome-copilot documentation-writer --pin v1.2.0

# Check installed skills for updates
gh skill update --all

# Validate and publish your own skills
gh skill publish --dry-run

Skills are automatically installed to the correct directory for your agent host. gh skill supports GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, and Antigravity. Target a specific agent and scope with --agent and --scope flags.

gh skill publish validates skills against the Agent Skills specification and checks remote settings like tag protection and immutable releases to improve supply chain security.

Read the full announcement on the GitHub Blog.

gh skill is launching in public preview and is subject to change without notice.

Official extension suggestions

When you run a command that matches a known official extension that isn't installed (e.g. gh stack), the CLI now offers to install it instead of showing a generic "unknown command" error.

This feature is available for github/gh-aw and github/gh-stack.

When possible, you'll be prompted to install immediately. When prompting isn't possible, the CLI prints the gh extension install command to run.

gh extension install no longer requires authentication

gh extension install previously required a valid auth token even though it only needs to download a public release asset. The auth check has been removed, so you can install extensions without being logged in.

What's Changed

✨ Features

• Add gh skill command group: install, preview, search, update, publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13165
• Suggest and install official extensions for unknown commands by @BagToad in https://github.com/cli/cli/pull/13175
• gh skill publish: auto-push unpushed commits before publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13171
• Disable auth check for gh extension install by @BagToad in https://github.com/cli/cli/pull/13176

🐛 Fixes

• Fix infinite loop in gh release list --limit 0 by @Bahtya in https://github.com/cli/cli/pull/13097
• Ensure api and auth commands record agentic invocations by @williammartin in https://github.com/cli/cli/pull/13046
• Disable auth check for local-only skill flags by @SamMorrowDrums in https://github.com/cli/cli/pull/13173
• URL-encode parentPath in skills discovery API call by @SamMorrowDrums in https://github.com/cli/cli/pull/13172
• Fix: use target directory remotes in skills publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13169
• Fix: preserve namespace in skills search deduplication by @SamMorrowDrums in https://github.com/cli/cli/pull/13170

📚 Docs & Chores

• docs: include PGP key fingerprints by @babakks in https://github.com/cli/cli/pull/13112
• docs: add sha/md5 checksums of keyring files by @babakks in https://github.com/cli/cli/pull/13150
• docs: fix SHA512 checksum for GPG key by @timsu92 in https://github.com/cli/cli/pull/13157
• docs(skill): polish skill commandset docs by @babakks in https://github.com/cli/cli/pull/13183
• Document dependency CVE policy in SECURITY.md by @BagToad in https://github.com/cli/cli/pull/13119
• Replace github.com/golang/snappy with klauspost/compress/snappy by @thaJeztah in https://github.com/cli/cli/pull/13048
• chore: bump to go1.26.2 by @babakks in https://github.com/cli/cli/pull/13116
• chore: delete experimental script/debian-devel by @babakks in https://github.com/cli/cli/pull/13127
• Suggest first party extensions by @williammartin in https://github.com/cli/cli/pull/13182
• Add cli/skill-reviewers as CODEOWNERS for skills packages by @BagToad in https://github.com/cli/cli/pull/13189
• Add @cli/code-reviewers to all CODEOWNERS rules by @BagToad in https://github.com/cli/cli/pull/13190
• Address post-merge review feedback for skills commands by @SamMorrowDrums in https://github.com/cli/cli/pull/13185
• Fix skills-publish-dry-run acceptance test error message mismatch by @SamMorrowDrums in https://github.com/cli/cli/pull/13187
• Skills: replace real git in publish tests with CommandStubber by @SamMorrowDrums in https://github.com/cli/cli/pull/13188
• Remove redundant nil-client fallback in skills publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13168
• Publish: use shared discovery logic instead of requiring skills/ directory by @SamMorrowDrums in https://github.com/cli/cli/pull/13167

:dependabot: Dependencies

• chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by @dependabot[bot] in https://github.com/cli/cli/pull/13071
• chore(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.8.2 by @dependabot[bot] in https://github.com/cli/cli/pull/13045
• chore(deps): bump charm.land/bubbles/v2 from 2.0.0 to 2.1.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13051
• chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 by @dependabot[bot] in https://github.com/cli/cli/pull/13152
• chore(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 by @dependabot[bot] in https://github.com/cli/cli/pull/13129
• chore(deps): bump github.com/sigstore/protobuf-specs from 0.5.0 to 0.5.1 by @dependabot[bot] in https://github.com/cli/cli/pull/13128
• chore(deps): bump github.com/in-toto/attestation from 1.1.2 to 1.2.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13044
• chore(deps): bump advanced-security/filter-sarif from 1.0.1 to 1.1 by @dependabot[bot] in https://github.com/cli/cli/pull/12918
• chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13076
• chore(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13065

New Contributors

• @thaJeztah made their first contribution in https://github.com/cli/cli/pull/13048
• @Bahtya made their first contribution in https://github.com/cli/cli/pull/13097
• @timsu92 made their first contribution in https://github.com/cli/cli/pull/13157
• @SamMorrowDrums made their first contribution in https://github.com/cli/cli/pull/13173

Full Changelog: https://github.com/cli/cli/compare/v2.89.0...v2.90.0