gh-auth-isolation

Manage multiple GitHub identities safely in agent workflows using gh CLI token extraction.

2|Updated Jul 24, 2026
One-click install
npx skills add https://github.com/elbruno/ElBruno.MagenticUI --skill gh-auth-isolation-elbruno
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gh-auth-isolation
Source: https://github.com/elbruno/ElBruno.MagenticUI/tree/main/.squad/templates/skills/gh-auth-isolation
Command: npx skills add https://github.com/elbruno/ElBruno.MagenticUI --skill gh-auth-isolation-elbruno

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? AI agents inherit the shell's default gh authentication, which is often an Enterprise Managed User (EMU) account. This causes failures when agents push to personal repos, create PRs on forks, or access resources outside the enterprise org, and naive fixes like global auth switching break parallel agents. ## Core Features & Use Cases - Identity Detection: Check the active GitHub account and token scopes with gh auth status before any operation. - Per-Operation Token Extraction: Pull a specific account's token with gh auth token --user and use it inline for pushes or PR creation without switching the global default. - Config Directory Isolation: Use GH_CONFIG_DIR and shell aliases to fully separate EMU and personal account contexts. - Use Case: An agent on an EMU-authenticated shell needs to push a blog post to a personal GitHub Pages repo. It extracts the personal token, pushes via token-authenticated HTTPS, then resets the remote URL so no credential persists. ## Quick Start Ask the agent to check gh auth status and push the current branch to your personal GitHub repo using your personal account token.

Frequently Asked Questions about gh-auth-isolation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I push to a personal GitHub repo when gh is logged into a work account?▼

Extract the personal account token with gh auth token --user yourname, then push via token-authenticated HTTPS: git push https://user:token@github.com/user/repo.git branch. Afterwards reset the remote URL so the token is not persisted.

How to create a PR from a personal fork using gh CLI?▼

Use gh pr create with the --repo flag targeting upstream and --head in the form username:branch. If the default token lacks access, set GH_TOKEN for that single command using gh auth token --user yourname.

Can I use two GitHub accounts with gh CLI at the same time?▼

Yes. gh stores multiple authenticated accounts, and you can extract per-account tokens with gh auth token --user. For full isolation, point GH_CONFIG_DIR at a separate config directory for the second account.

Why does git push fail with permission denied on my personal repo?▼

The shell's default gh authentication is likely your EMU work account, which has no access to personal repositories. Verify with gh auth status, then authenticate the push with your personal account's token.

Is it safe to switch accounts with gh auth login in agent sessions?▼

No. Switching the global default mid-session affects all processes and parallel agents sharing the shell. Prefer per-command token extraction or GH_CONFIG_DIR isolation, which leave the default context untouched.