study-github-repo — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited study-github-repo (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Clone a GitHub repository locally, study it systematically across 14 dimensions, and produce a comprehensive report in the configured output language (defaulting to English).
Prerequisite:ghCLI installed and authenticated. Verify withgh auth status.
Extract {owner} and {repo} from the GitHub URL. Accept any of these formats:
https://github.com/{owner}/{repo}github.com/{owner}/{repo}{owner}/{repo}Fetch metadata via gh api before cloning (lightweight, fast):
# Repo overview
gh api 'repos/{owner}/{repo}' --jq '{
description, stargazers_count, forks_count,
language, license: .license.spdx_id,
topics, created_at, updated_at, open_issues_count,
default_branch, archived, size
}'
# Language breakdown
gh api 'repos/{owner}/{repo}/languages'
# Recent releases (last 5)
gh api 'repos/{owner}/{repo}/releases?per_page=5' --jq '.[].tag_name'
# Contributors (top 10)
gh api 'repos/{owner}/{repo}/contributors?per_page=10' --jq '.[] | {login, contributions}'
# Recent commits (last 30)
gh api 'repos/{owner}/{repo}/commits?per_page=30' --jq '.[] | {date: .commit.author.date, message: .commit.message | split("\n")[0]}'
# Recent issues (last 10, all states)
gh api 'repos/{owner}/{repo}/issues?state=all&per_page=10' --jq '.[] | {number, title, state, labels: [.labels[].name]}'
# Recent PRs (last 10, all states)
gh api 'repos/{owner}/{repo}/pulls?state=all&per_page=10' --jq '.[] | {number, title, state, merged_at}'mkdir -p .tmp/github_study
gh repo clone {owner}/{repo} .tmp/github_study/{owner}_{repo} -- --depth=1 \
-c url.https://github.com/[email protected]:Use --depth=1 for a shallow clone (faster, smaller). The -c url...insteadOf flag forces HTTPS to avoid SSH key issues. Full history is not needed — commit metadata is already fetched via API.
Build a rough mental map of the repo. Read these in order:
find .tmp/github_study/{owner}_{repo} -not -path '*/.git/*' -not -path '*/node_modules/*' -not -path '*/__pycache__/*' -not -path '*/dist/*' -not -path '*/build/*' -not -path '*/.venv/*' | head -200 to see the structure (or use tree -L 3 -I '...' if available)docs/ or similar exists, scan for architecture docs, guides, or design documentsexamples/ exists, read a representative example to understand typical usageFollow one real execution path from input to output:
main.py, index.ts, server.js, app.ts, src/index.*, cmd/, bin/, CLI entry files, API routersThere is no artificial file cap. Use engineering judgment to determine when you have enough understanding to explain how the repo delivers on its README promise. For large repos, focus on the core module rather than peripheral utilities.
Using your understanding from Phases 1-2, now systematically investigate each dimension:
Use grep_search / ripgrep to search for patterns across the codebase without reading full files. Examples:
grep -r "class.*Base\|class.*Abstract\|interface " --include="*.py" --include="*.ts"grep -r "log\.\|logger\.\|console\.log\|logging\." --include="*.py" --include="*.ts" -lgrep -r "test\|describe\|it(" --include="*test*" --include="*spec*" -lCheck data/user_preferences.md for the Preferred Output Language configuration, and write the report in that language (defaulting to English if not configured).
📄 Read assets/output_template.md for the full report template.Write the report to reports/GitHub/{owner}_{repo}.md. Every section must contain substantive content — no empty sections. If a dimension is not applicable (e.g., "State Management" for a pure utility library), explain why it's not relevant rather than leaving it blank.
The four executive summary questions must be answered:
For private/internal repos with sparse community metrics (0 stars, no releases), note this factually in Repo Health: "This appears to be a private/internal repository; community health metrics are not applicable."
rm -rf .tmp/github_study/{owner}_{repo}Confirm to the user: "✅ Report saved to reports/GitHub/{owner}_{repo}.md. Clone cleaned up."
"⚠️ GitHub CLI is not authenticated. Run 'gh auth login' first.""⚠️ Repository {owner}/{repo} not found or you don't have access."~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.