github-via-nyxid

# Operate GitHub via NyxID ## Overview This skill lets an AI agent act on a user's **GitHub** account using the GitHub REST API — read repos, open issues and pull requests, commit files, trigger Actions, etc. — **on the user's behalf**. The one premise: the agent **never holds a GitHub token**. Every call goes through **NyxID's credential-brokering proxy** for the connected service **`api-github`**. NyxID stores the user's GitHub credential (connected via OAuth — "the GitHub account the user bound in NyxID") encrypted at rest, strips any client Authorization header, injects the GitHub credential server-side, and forwards the request to `https://api.github.com`. You only ever send your **NyxID** bearer; you never see, request, or log the GitHub token. > **What "operate GitHub" really means here:** anything the GitHub REST API allows **and** > that the OAuth scopes granted to the `api-github` connection permit. The ceiling is the > granted scopes, not the entire API surface (see [Scopes & permissions](#scopes--permissions)). ## 1. Preflight — confirm GitHub is connected Before the first call, confirm the user has the `api-github` service connected in NyxID. In an Aevatar turn, call the available `nyxid_service_inventory` with `{}` and select an exact `user_service_id`; use only the schema emitted for that request. The CLI and raw HTTP remain operator alternatives: - CLI: `nyxid service list --output json` → look for an entry with `"slug": "api-github"`. - Raw HTTP: `GET ...