# Github Outside Sandbox

Run Git and GitHub CLI commands on the host when sandboxing blocks Keychain auth...

- Repository: https://github.com/davidondrej/skills (4238 stars)
- Category: Git and review
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add davidondrej/skills --skill github-outside-sandbox -g -a claude-code -y`
Codex: `npx skills add davidondrej/skills --skill github-outside-sandbox -g -a codex -y`
Cursor: `npx skills add davidondrej/skills --skill github-outside-sandbox -g -a cursor -y`
Gemini CLI: `npx skills add davidondrej/skills --skill github-outside-sandbox -g -a gemini-cli -y`

## Description

Run Git and GitHub CLI commands on the host when sandboxing blocks Keychain auth, network access, or .git writes. Use for gh auth, repo/PR operations, index.lock, or permission errors; covers execution context only.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# GitHub Outside Sandbox

1. Start normally. Escalate only the blocked command and only within the user's authorization.
2. If sandboxed `gh auth status` fails, rerun it outside the sandbox before claiming authentication is broken. Never expose or copy tokens.
3. Run GitHub CLI network operations outside the sandbox when required: `gh repo ...`, `gh pr ...`, and related `gh` commands.
4. Run Git writes outside the sandbox when `.git` is outside writable roots or errors mention `index.lock` or `Operation not permitted`: `git add`, `git commit`, and `git push`.
5. Use the harness's official host-execution mechanism. In Codex, set `sandbox_permissions: "require_escalated"`, give a concrete `justification`, and use only a narrow safe `prefix_rule` when appropriate.
6. Never use shell wrappers, credential copying, or broad approval prefixes to bypass the sandbox.
7. Verify from the host context with `git status -sb`, `git remote -v`, and the relevant `gh ... view` command. Ask the user to authenticate only if the host-context check also fails.