# GitHub App permissions

> Every permission the Skipbox CI and Skipbox (personal) apps ask for, what Skipbox does with each, and what neither asks for.

## Skipbox CI (organizations)

| Permission | Access | What Skipbox does with it |
|---|---|---|
| Organization: Self-hosted runners | Read and write | Adds a runner for each job that asks for one, and removes it when the job ends |
| Repository: Actions | Read | Sees when a job waits for its runner, lists your jobs on the dashboard, and reads your last 30 days of runs to recommend plans |
| Repository: Metadata | Read | Repository names, and whether each is private |
| Account: Email addresses | Read | Your address, for trial and billing emails |

This app can't read your code. Each job checks out your code itself, inside its own VM.

## Skipbox (personal)

| Permission | Access | What Skipbox does with it |
|---|---|---|
| Repository: Administration | Read and write | Adds a runner to the job's repository for one job, and removes it when the job ends |
| Repository: Actions | Read | The same as above, and shows your workflow files on the dashboard |
| Repository: Metadata | Read | Repository names, and whether each is private |

On a personal account, GitHub registers runners on a repository only with the Administration permission. It also covers the repository's settings, collaborators and deploy keys. Skipbox calls only the runner endpoints with it.

## What neither app asks for

Contents, Workflows, Secrets and Pull requests. Skipbox never changes a workflow, never pushes, and never opens a pull request. Actions access is read only: it can't start, re-run or cancel a run.

## What a job's VM holds

As on any runner, GitHub sends the job's VM your code, the secrets your workflow passes to the job, and a token for that job. Code the job runs can read them. They stay in that VM and are deleted with it. See [VM isolation](https://docs.skipbox.dev/isolation).

## Change or remove access

On GitHub, open the app's **Configure** page to change which repositories it may use, or to uninstall it. See [Cancel and uninstall](https://docs.skipbox.dev/cancel).

Updated 2026-11-09 · https://docs.skipbox.dev/permissions