Gh security audit

Skill K-Oxon/gh-security-audit-skill/skills/gh-security-audit

Read-only remote GitHub repository security settings audit using gh api for one OWNER/REPO.From its SKILL.md

Install

npx -y skills add K-Oxon/gh-security-audit-skill --skill gh-security-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, 576 tokens by cl100k_base, as published. Nobody here has run it

gh-security-audit

Use this skill when the user asks to audit GitHub repository security settings or Actions repository settings for a specific OWNER/REPO.

This skill is read-only. Do not change repository settings, open pull requests, commit files, dismiss alerts, enable features, or run remediation commands.

Inputs

Require a repository in OWNER/REPO form. If the owner or repo is ambiguous, ask for clarification before calling GitHub APIs.

Workflow

Read references/command_recipe.md.
Run the read-only gh api recipe with OWNER, REPO, and API_VERSION=2026-03-10.
Store raw API output only in a temporary directory.
Interpret results with references/finding_model.md.
Use official source links from references/github_api_sources.md when explaining API behavior.
Produce Markdown and JSON from the same finding set.

Output

Markdown must contain:

Summary
Scope and assumptions
Collection status
Observed security settings
Branch protection and rules inventory
Alert availability and counts
Actions, deployment, and runtime inventory
Manual or unavailable checks
Data access and limitations
Optional review notes

JSON must include schema_version, subject, policy_context, findings, and limitations. Use schema_version: "0.1".

See examples/sample_report.md and examples/sample_findings.json for the expected shape of both formats.

Default v0.1 output is inventory-first. Report observed values, counts, and API limitations before making any recommendation. If a status is included, assign it only from the deterministic rules in references/finding_model.md; do not infer severity from general security intuition.

v0.1 Boundaries

Do not include workflow file diagnostics, zizmor, Scorecard, local clone inspection, cloud provider trust-policy inspection, or automatic fixes in v0.1 results. Mark those as SKIP, MANUAL, or out of scope as appropriate.

Do not treat repository ruleset count as a default-branch protection verdict. Use active default-branch rules and legacy branch protection evidence.

Do not treat CodeQL default setup as proof that all code scanning is absent. Advanced setup and third-party SARIF upload require separate evidence.

Never turn API access failures, permission gaps, feature-disabled responses, or plan differences into FAIL. Record them as limitations.

Do not use FAIL unless the user explicitly asks to apply a policy profile that defines failure conditions.

Never output secret scanning secret values or location details. Never output Actions, Dependabot, environment, or Codespaces secret values.