發布日期：2026-04-16
你現在能用 gh skill 把技能（skill，教 AI 或工具完成特定工作的說明包）找出來、預覽、安裝、更新或發布。打錯未知指令時，GitHub CLI 會建議可安裝的官方擴充功能；安裝擴充功能與只在本機使用的技能選項，也不再先要求登入。api 與 auth 指令也會記錄 AI 代理呼叫。發布前會推送尚未推送的提交，並改用目標資料夾的遠端設定。這次也修好搜尋時誤把不同命名空間的同名技能合併、路徑含特殊字元找不到技能，以及 gh release list --limit 0 無限迴圈等問題。像逛工具店：能先看貨、直接帶回家，結帳時店員也會把你手上的清單一併送出。
你在驗證下載檔或發布技能時，能看到更完整的安全與操作說明。文件補上 PGP 金鑰指紋、金鑰環檔案的 SHA／MD5 校驗碼、正確的 SHA512 值，以及相依套件 CVE 漏洞處理政策；技能指令與 agent skills 也補齊文件。程式內部則升級 Go、替換壓縮套件、移除過時的 Debian 開發腳本，並替官方擴充功能與技能套件補上建議、審查負責人、共用探索流程和測試。發布測試不再真的呼叫 Git，--dry-run 的錯誤訊息也一致，並移除多餘的備援邏輯。像寄掛號信：封條、驗證碼與收件規則都寫清楚，寄件流程也先在練習櫃台跑過。
這版也整理了 GitHub CLI 看不見但支撐日常運作的零件：壓縮、Markdown、終端機介面、容器映像、簽章、驗證、資安掃描、網路通訊與版本判讀等相依套件都升級。這些更新沒有替你多一顆按鈕，而是讓底層零件跟上各自的新版本；同時也記錄了五位首次貢獻者。像保養一台車：引擎裡的皮帶、濾網和接頭逐一換新，儀表板看起來一樣，行車靠的卻是它們。
You can now use gh skill to search for, preview, install, update, and publish skills: instruction packages that teach an AI or tool a particular job. If you enter an unknown command, GitHub CLI can suggest an official extension to install. Installing extensions and local-only skill options no longer require an authentication check. The api and auth commands also record agentic invocations. Publishing now pushes unpushed commits first and uses the target directory's remote. Search also keeps same-named skills from different namespaces separate, handles encoded parent paths, and gh release list --limit 0 no longer loops forever. It is like a tool shop where you can inspect an item, take it home, and have the clerk send your pending paperwork with it.
You now get clearer security and operating notes when verifying downloads or publishing skills. Documentation adds PGP key fingerprints, SHA/MD5 checksums for keyring files, the corrected SHA512 value, and a dependency CVE policy; it also documents skill commands and agent skills. Internally, the CLI updates Go, replaces a compression package, removes an old Debian development script, and adds recommendations, code reviewers, shared discovery, and tests around official extensions and skill packages. Publish tests no longer invoke real Git, --dry-run messages match, and redundant fallback logic is gone. It is like registered mail: the seal, verification code, and delivery rules are explicit, and the route has been rehearsed at a practice counter.
This release also refreshes the invisible parts that support GitHub CLI: dependencies for compression, Markdown, terminal interfaces, container images, signing, attestation, security scanning, network communication, and version parsing all move forward. These updates do not add a button for you; they keep the underlying parts on their newer releases. The notes also credit five first-time contributors. It is like servicing a car: belts, filters, and connectors inside the engine are renewed one by one, while the dashboard looks the same and the drive depends on them.
Add `gh skill` command group: install, preview, search, update, publish by @SamMorrowDrums and @tommaso-moro in https://github.com/cli/cli/pull/13165
Suggest and install official extensions for unknown commands by @BagToad in https://github.com/cli/cli/pull/13175
`gh skill publish`: auto-push unpushed commits before publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13171
Disable auth check for `gh extension install` by @BagToad in https://github.com/cli/cli/pull/13176
Fix infinite loop in `gh release list --limit 0` by @Bahtya in https://github.com/cli/cli/pull/13097
Ensure `api` and `auth` commands record agentic invocations by @williammartin in https://github.com/cli/cli/pull/13046
Disable auth check for local-only skill flags by @SamMorrowDrums in https://github.com/cli/cli/pull/13173
URL-encode parentPath in skills discovery API call by @SamMorrowDrums in https://github.com/cli/cli/pull/13172
Fix: use target directory remotes in skills publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13169
Fix: preserve namespace in skills search deduplication by @SamMorrowDrums in https://github.com/cli/cli/pull/13170docs: include PGP key fingerprints by @babakks in https://github.com/cli/cli/pull/13112
docs: add sha/md5 checksums of keyring files by @babakks in https://github.com/cli/cli/pull/13150
docs: fix SHA512 checksum for GPG key by @timsu92 in https://github.com/cli/cli/pull/13157
docs(skill): polish skill commandset docs by @babakks in https://github.com/cli/cli/pull/13183
Document dependency CVE policy in SECURITY.md by @BagToad in https://github.com/cli/cli/pull/13119
Replace github.com/golang/snappy with klauspost/compress/snappy by @thaJeztah in https://github.com/cli/cli/pull/13048
chore: bump to go1.26.2 by @babakks in https://github.com/cli/cli/pull/13116
chore: delete experimental script/debian-devel by @babakks in https://github.com/cli/cli/pull/13127
Suggest first party extensions by @williammartin in https://github.com/cli/cli/pull/13182
Add cli/skill-reviewers as CODEOWNERS for skills packages by @BagToad in https://github.com/cli/cli/pull/13189
Add @cli/code-reviewers to all CODEOWNERS rules by @BagToad in https://github.com/cli/cli/pull/13190
Address post-merge review feedback for skills commands by @SamMorrowDrums in https://github.com/cli/cli/pull/13185
Fix skills-publish-dry-run acceptance test error message mismatch by @SamMorrowDrums in https://github.com/cli/cli/pull/13187
Skills: replace real git in publish tests with CommandStubber by @SamMorrowDrums in https://github.com/cli/cli/pull/13188
Remove redundant nil-client fallback in skills publish by @SamMorrowDrums in https://github.com/cli/cli/pull/13168
Publish: use shared discovery logic instead of requiring skills/ directory by @SamMorrowDrums in https://github.com/cli/cli/pull/13167chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by @dependabot[bot] in https://github.com/cli/cli/pull/13071
chore(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.8.2 by @dependabot[bot] in https://github.com/cli/cli/pull/13045
chore(deps): bump charm.land/bubbles/v2 from 2.0.0 to 2.1.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13051
chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 by @dependabot[bot] in https://github.com/cli/cli/pull/13152
chore(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 by @dependabot[bot] in https://github.com/cli/cli/pull/13129
chore(deps): bump github.com/sigstore/protobuf-specs from 0.5.0 to 0.5.1 by @dependabot[bot] in https://github.com/cli/cli/pull/13128
chore(deps): bump github.com/in-toto/attestation from 1.1.2 to 1.2.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13044
chore(deps): bump advanced-security/filter-sarif from 1.0.1 to 1.1 by @dependabot[bot] in https://github.com/cli/cli/pull/12918
chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13076
chore(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by @dependabot[bot] in https://github.com/cli/cli/pull/13065
@thaJeztah made their first contribution in https://github.com/cli/cli/pull/13048
@Bahtya made their first contribution in https://github.com/cli/cli/pull/13097
@timsu92 made their first contribution in https://github.com/cli/cli/pull/13157
@SamMorrowDrums made their first contribution in https://github.com/cli/cli/pull/13173
@tommaso-moro made their first contribution in https://github.com/cli/cli/pull/13165