Built-in skill `github-pr-media` cannot run: `gh auth token` is empty in a cloud agent session, and the endpoint rejects `Bearer`

查看 builtin-skills/github-pr-media/SKILL.md。該 issue 描述了三個缺陷：Authorization 標頭使用了錯誤的方案和令牌來源，最終的 PR 編輯步驟需要一個額外的範圍，以及存在一個未使用的環境變數。首先閱讀技能檔案以查看 curl 指令和 gh pr edit 呼叫。測試提議的修復：將 'Bearer $(gh auth token)' 更改為 'token $GITHUB_COPILOT_API_TOKEN'，並將 gh pr edit 替換為 gh api --method PATCH。檢查 copilot_swe_agent_use_attachment_proxy 是否在程式碼庫中的任何地方被引用。通過端到端執行該技能，驗證變更在雲端代理工作階段中是否有效。

Describe the bug

The runtime ships builtin-skills/github-pr-media/SKILL.md. Run as written inside a Copilot cloud agent session, it fails at every step. A session can attach media - its own credential works -but not by following this skill.

Fault 1 - the authorization line is wrong twice

-H "Authorization: Bearer $(gh auth token)"

• gh auth token returns nothing in a session. GH_TOKEN, GITHUB_TOKEN and GH_ENTERPRISE_TOKEN are all unset, and gh auth status reports the default token as invalid.
• Bearer is the wrong scheme for this endpoint. It answers 404 Not Found, which reads as a missing endpoint rather than a wrong header.

Fault 2 - the final step needs a scope the session does not have

The skill finishes with gh pr edit --body-file -. That always requests the reviewRequests field, so it needs read:org. See cli/cli #13575, still open. gh api --method PATCH repos/{owner}/{repo}/pulls/{n} has no such requirement.

What actually works

A session holds GITHUB_COPILOT_API_TOKEN, a ghu_ GitHub App user-to-server token, and the attachment endpoint accepts it:

curl --fail-with-body -sS -X POST "$GITHUB_UPLOADS_URL" \
  --url-query "name=e.png" --url-query "content_type=image/png" \
  --url-query "repository_id=$GITHUB_REPOSITORY_ID" \
  -H "Content-Type: application/octet-stream" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  -H "Authorization: token $GITHUB_COPILOT_API_TOKEN" \
  --data-binary @e.png

HTTP/2 201
{"url":"https://<host>/user-attachments/assets/<uuid>"}

Six variants in one session, changing only the Authorization header:

Credential	Scheme	Answer
GITHUB_COPILOT_API_TOKEN	Bearer	HTTP/2 404
GITHUB_COPILOT_API_TOKEN	token	HTTP/2 201
COPILOT_SDK_AUTH_TOKEN	Bearer	HTTP/2 404
COPILOT_SDK_AUTH_TOKEN	token	HTTP/2 201
GITHUB_VERIFICATION_TOKEN	Bearer	HTTP/2 404
none	-	HTTP/2 404

The whole route then ran end to end in one session: make a PNG, open a draft pull request, upload, place the URL in the description with the harness tool, delete the file from the branch. The capture still renders, because the asset does not live in the repository.

Fault 3 - a flag that names nothing

The session environment carries copilot_swe_agent_use_attachment_proxy=true. I tested every local listener looking for what it selects. The Copilot API proxy answers 403 and the git credential proxy answers 406, and nothing in the runtime bundle reads that variable. Either wire it up or drop it, because it reads like a supported route and is not one.

What I ask for

1. Change the skill to Authorization: token $GITHUB_COPILOT_API_TOKEN.
2. Change its final step to gh api --method PATCH, or to the harness tool that writes the description.
3. Remove or implement copilot_swe_agent_use_attachment_proxy.

Related: cli/cli refuses ghu_ in --attach for the same endpoint, which is the other half of why this looks unreachable. I filed that separately in #14495

Affected version

No response

Steps to reproduce the behavior

No response

Expected behavior

No response

Additional context

No response