Built-in skill `github-pr-media` cannot run: `gh auth token` is empty in a cloud agent session, and the endpoint rejects `Bearer`

Xem builtin-skills/github-pr-media/SKILL.md. Issue mô tả ba lỗi: tiêu đề Authorization sử dụng scheme và nguồn token sai, bước chỉnh sửa PR cuối cùng yêu cầu một phạm vi bổ sung và có một biến môi trường không được sử dụng. Bắt đầu bằng cách đọc tệp kỹ năng để xem lệnh curl và lệnh gọi gh pr edit. Kiểm tra bản sửa lỗi được đề xuất: đổi 'Bearer $(gh auth token)' thành 'token $GITHUB_COPILOT_API_TOKEN' và thay thế gh pr edit bằng gh api --method PATCH. Kiểm tra xem copilot_swe_agent_use_attachment_proxy có được tham chiếu ở bất kỳ đâu trong codebase không. Xác minh các thay đổi hoạt động trong phiên đại lý đám mây bằng cách chạy kỹ năng từ đầu đến cuối.

Describe the bug

The runtime ships builtin-skills/github-pr-media/SKILL.md. Run as written inside a Copilot cloud agent session, it fails at every step. A session can attach media - its own credential works -but not by following this skill.

Fault 1 - the authorization line is wrong twice

-H "Authorization: Bearer $(gh auth token)"

• gh auth token returns nothing in a session. GH_TOKEN, GITHUB_TOKEN and GH_ENTERPRISE_TOKEN are all unset, and gh auth status reports the default token as invalid.
• Bearer is the wrong scheme for this endpoint. It answers 404 Not Found, which reads as a missing endpoint rather than a wrong header.

Fault 2 - the final step needs a scope the session does not have

The skill finishes with gh pr edit --body-file -. That always requests the reviewRequests field, so it needs read:org. See cli/cli #13575, still open. gh api --method PATCH repos/{owner}/{repo}/pulls/{n} has no such requirement.

What actually works

A session holds GITHUB_COPILOT_API_TOKEN, a ghu_ GitHub App user-to-server token, and the attachment endpoint accepts it:

curl --fail-with-body -sS -X POST "$GITHUB_UPLOADS_URL" \
  --url-query "name=e.png" --url-query "content_type=image/png" \
  --url-query "repository_id=$GITHUB_REPOSITORY_ID" \
  -H "Content-Type: application/octet-stream" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  -H "Authorization: token $GITHUB_COPILOT_API_TOKEN" \
  --data-binary @e.png

HTTP/2 201
{"url":"https://<host>/user-attachments/assets/<uuid>"}

Six variants in one session, changing only the Authorization header:

Credential	Scheme	Answer
GITHUB_COPILOT_API_TOKEN	Bearer	HTTP/2 404
GITHUB_COPILOT_API_TOKEN	token	HTTP/2 201
COPILOT_SDK_AUTH_TOKEN	Bearer	HTTP/2 404
COPILOT_SDK_AUTH_TOKEN	token	HTTP/2 201
GITHUB_VERIFICATION_TOKEN	Bearer	HTTP/2 404
none	-	HTTP/2 404

The whole route then ran end to end in one session: make a PNG, open a draft pull request, upload, place the URL in the description with the harness tool, delete the file from the branch. The capture still renders, because the asset does not live in the repository.

Fault 3 - a flag that names nothing

The session environment carries copilot_swe_agent_use_attachment_proxy=true. I tested every local listener looking for what it selects. The Copilot API proxy answers 403 and the git credential proxy answers 406, and nothing in the runtime bundle reads that variable. Either wire it up or drop it, because it reads like a supported route and is not one.

What I ask for

1. Change the skill to Authorization: token $GITHUB_COPILOT_API_TOKEN.
2. Change its final step to gh api --method PATCH, or to the harness tool that writes the description.
3. Remove or implement copilot_swe_agent_use_attachment_proxy.

Related: cli/cli refuses ghu_ in --attach for the same endpoint, which is the other half of why this looks unreachable. I filed that separately in #14495

Affected version

No response

Steps to reproduce the behavior

No response

Expected behavior

No response

Additional context

No response