# Add to your Claude Code skills
git clone https://github.com/github/gh-awLast scanned: 4/20/2026
{
"issues": [],
"status": "PASSED",
"scannedAt": "2026-04-20T06:14:47.951Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}See how gh-aw compares with popular alternatives.
gh-aw is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by github. GitHub Agentic Workflows. It has 5,368 GitHub stars.
Yes. gh-aw passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/github/gh-aw" and add it to your Claude Code skills directory (see the Installation section above). gh-aw ships a SKILL.md manifest, so compatible agents can discover and load it automatically.
gh-aw is primarily written in Go. It is open-source under github on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh gh-aw against similar tools.
No comments yet. Be the first to share your thoughts!
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
gh-aw) is a GitHub CLI extension for writing Agentic Workflows in markdown and compiling them to GitHub Actions.gh extension install github/gh-aw
If failed,
curl -sL https://raw.githubusercontent.com/github/gh-aw/main/install-gh-aw.sh | bash
Load https://github.com/github/gh-aw/blob/main/.github/skills/agentic-workflows/SKILL.md to learn how to create/update/debug/optimize Agentic Workflows.
Hello fellow agent! Welcome to GitHub Agentic Workflows = Actions + Agent + Safety. Here are some pointers to get you started in using this tool.
GitHub Agentic Workflows (gh-aw) lets developers define AI-powered repository automation in Markdown with YAML frontmatter and run AI agents securely through GitHub Actions. The gh-aw GitHub CLI extension compiles each agentic workflow into a standard GitHub Actions workflow.
Use conventional GitHub Actions for deterministic builds, tests, linting, deployments, and reproducible scripts. Add an agentic workflow when a task needs reasoning or interpretation, such as issue triage, pull-request review, CI failure investigation, documentation maintenance, dependency analysis, or repository reporting. GitHub Agentic Workflows complements existing CI/CD; it does not replace it.
Built-in AI engines include GitHub Copilot, Claude Code, OpenAI Codex, Google Gemini, and Pi. Agent jobs are read-only and sandboxed by default, and configured GitHub writes are normally applied through validated safe-outputs jobs with scoped permissions.
[!NOTE] A security vulnerability was discovered in versions
>= 0.83.3, < 0.85.4and, as a result, those releases were retired as a pre-emptive measure.
Install the GitHub CLI extension:
gh extension install github/gh-aw
Then follow the GitHub Agentic Workflows quickstart to select an AI engine, add a sample workflow, and run it through GitHub Actions.
An agentic workflow has two parts: YAML frontmatter configures triggers, permissions, tools, and the AI engine; the Markdown body tells the AI agent what to accomplish. The gh aw compile command validates this source and generates the .lock.yml workflow that GitHub Actions executes. Learn how GitHub Agentic Workflows works.
Security, permissions, and controlled writes are core design concerns. The supported agent-job path defaults to read-only GitHub access and sandboxed execution. Safe outputs buffer configured writes, validate them, and apply them in separate jobs with scoped permissions. These controls are configurable, so workflow authors must review permissions, tools, network access, and generated files before deployment. Learn how GitHub Agentic Workflows handles security and permissions.
Using agentic workflows in your repository requires careful attention to security considerations and careful human supervision, and even then things can still go wrong. Use it with caution, and at your own risk.
Use the GitHub Agentic Workflows documentation for these paths:
For AI agents and retrieval tools, use the published agent prompt index, full prompt corpus, and AI-readable project summary.
For development setup and contribution guidelines, see CONTRIBUTING.md.
To build and test repository custom linters:
go test ./pkg/linters/<linter-name>/...go build ./cmd/lintersmake golint-custommake golint-custom builds cmd/linters and runs the custom analyzers against ./cmd/... and ./pkg/....
Community members whose issues were resolved — updated automatically.
@a-sjogren-accenture (2) @aaronspindler (1) @abbottdev (3) @abillingsley (2) @adam-cobb (1) @adamhenson (2) @adamtasteslikegood (1) @adhikjoshi (1) @aharper-srsacquiom (1) @ahmadabdalla (1) @ajfeldman6 (1) @akkikumar72 (1) @AkshatRaj00 (1) @alanpeabody (1) @alcastaneda (1) @AlexanderWert (1) @AlexDeMichieli (1) @alexsiilvaa (2) @alirezamirian (1) @alondahari (18) @alvistar (2) @AmoebaChant (1) @anthonymastreanvae (11) @aoxiangtianyu-go (1) @apenab (1) @arabkin (1) @arezero (6) @Arithmomaniac (1) @arthurfvives (8) @Artur- (1) @asatara (1) @askpaisa (1) @askpt (1) @astefan (1) @awoisoak (1) @b-dantas (1) @b2pacific (1) @babaakihiro (2) @bartul (1) @bbonafed (23) @beardofedu (1)