exploring-github — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited exploring-github (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Explore and understand GitHub repositories using the gh CLI — a zero-dependency alternative to MCP-based GitHub context servers like gitctx.
gh CLI installed and authenticatedIf gh is not found or not authenticated, stop and ask the user to install/authenticate it. If a command fails for a non-blocking reason (e.g., rate limit on a non-critical call), skip it and continue.
Maintain a mental "current repo" context. Once the user specifies a repo (e.g., rust-lang/rust), use -R owner/repo on all subsequent gh commands. Track:
OWNER/REPO — always pass via -R--branch or @ref where applicableFind/search repos:
gh search repos "<query>" --sort stars --limit 10 --json fullName,description,stargazersCount,language,updatedAtView repo metadata:
gh repo view OWNER/REPO --json name,description,defaultBranchRef,isPrivate,diskUsage,forkCount,stargazerCount,languages,homepageUrlList branches:
gh api repos/OWNER/REPO/branches --paginate --jq '.[].name'List directory contents (root or subdir):
gh api repos/OWNER/REPO/contents/PATH --jq '.[] | "\(.type)\t\(.name)\t\(.size // "")"' -H "Accept: application/vnd.github.v3+json"For a specific branch:
gh api "repos/OWNER/REPO/contents/PATH?ref=BRANCH" --jq '.[] | "\(.type)\t\(.name)\t\(.size // "")"'Read a file:
gh api repos/OWNER/REPO/contents/PATH -H "Accept: application/vnd.github.v3.raw" 2>&1 | head -500For a specific branch:
gh api "repos/OWNER/REPO/contents/PATH?ref=BRANCH" -H "Accept: application/vnd.github.v3.raw" 2>&1 | head -500Read multiple files (run in parallel): Read each file with the command above. Run multiple Bash calls in parallel for efficiency.
Get full repo tree (recursive):
gh api repos/OWNER/REPO/git/trees/BRANCH?recursive=1 --jq '.tree[] | select(.type=="blob") | .path' | head -200Search code in a repo:
gh search code "<query>" --repo OWNER/REPO --limit 20 --json path,textMatchesSearch code globally:
gh search code "<query>" --language LANG --limit 20 --json repository,path,textMatchesList/search issues:
gh issue list -R OWNER/REPO --state all --search "<query>" --limit 20 --json number,title,state,author,labels,createdAt,updatedAtGet issue details:
gh issue view NUMBER -R OWNER/REPO --json number,title,state,body,author,labels,assignees,comments,createdAt,closedAtList issue comments:
gh issue view NUMBER -R OWNER/REPO --json comments --jq '.comments[] | "[\(.author.login) \(.createdAt)]\n\(.body)\n---"'List/search PRs:
gh pr list -R OWNER/REPO --state all --search "<query>" --limit 20 --json number,title,state,author,labels,baseRefName,headRefName,createdAt,mergedAtGet PR details:
gh pr view NUMBER -R OWNER/REPO --json number,title,state,body,author,labels,assignees,comments,reviews,additions,deletions,changedFiles,baseRefName,headRefName,mergedAt,mergedByGet PR diff:
gh pr diff NUMBER -R OWNER/REPOList PR review comments:
gh api repos/OWNER/REPO/pulls/NUMBER/comments --jq '.[] | "[\(.user.login) \(.created_at) \(.path):\(.line // .original_line)]\n\(.body)\n---"'List commits:
gh api repos/OWNER/REPO/commits --paginate -f sha=BRANCH -f per_page=20 --jq '.[] | "\(.sha[:8]) \(.commit.author.date) \(.commit.author.name): \(.commit.message | split("\n")[0])"'With path filter:
gh api repos/OWNER/REPO/commits -f sha=BRANCH -f path=PATH -f per_page=20 --jq '.[] | "\(.sha[:8]) \(.commit.author.date) \(.commit.author.name): \(.commit.message | split("\n")[0])"'With author filter:
gh api repos/OWNER/REPO/commits -f sha=BRANCH -f author=USERNAME -f per_page=20 --jq '.[] | "\(.sha[:8]) \(.commit.author.date): \(.commit.message | split("\n")[0])"'Get commit details:
gh api repos/OWNER/REPO/commits/SHA --jq '{sha: .sha, message: .commit.message, author: .commit.author, files: [.files[] | {filename, status, additions, deletions, patch}]}'Compare commits/refs:
gh api repos/OWNER/REPO/compare/BASE...HEAD --jq '{ahead_by, behind_by, total_commits: .total_commits, files: [.files[] | {filename, status, additions, deletions}], commits: [.commits[] | {sha: .sha[:8], message: .commit.message | split("\n")[0]}]}'Blame a file:
gh api graphql -f query='
query {
repository(owner: "OWNER", name: "REPO") {
object(expression: "BRANCH:PATH") {
... on Blob {
blame {
ranges {
startingLine
endingLine
commit {
abbreviatedOid
message
author { name date }
}
}
}
}
}
}
}
' --jq '.data.repository.object.blame.ranges[] | "L\(.startingLine)-\(.endingLine) \(.commit.abbreviatedOid) \(.commit.author.name) (\(.commit.author.date)): \(.commit.message | split("\n")[0])"'List releases:
gh release list -R OWNER/REPO --limit 20 --json tagName,name,publishedAt,isPrerelease,isDraft,isLatestGet release details:
gh release view TAG -R OWNER/REPO --json tagName,name,body,publishedAt,author,assets,isPrerelease,isDraftCompare releases (commits between two tags):
gh api repos/OWNER/REPO/compare/TAG1...TAG2 --jq '{total_commits: .total_commits, commits: [.commits[] | {sha: .sha[:8], message: .commit.message | split("\n")[0]}], files_changed: [.files[] | .filename]}'Top contributors:
gh api repos/OWNER/REPO/contributors -f per_page=20 --jq '.[] | "\(.login): \(.contributions) commits"'Repository stats (commit activity):
gh api repos/OWNER/REPO/stats/participation --jq '"Owner commits (last 52 weeks): \(.owner | add)\nAll commits (last 52 weeks): \(.all | add)"'Language breakdown:
gh api repos/OWNER/REPO/languagesDependency graph (if available):
gh api repos/OWNER/REPO/dependency-graph/sbom --jq '.sbom.packages[:30][] | "\(.name) \(.versionInfo // "unknown")"'This skill is best used via a subagent (e.g. Claude Code's Task tool, or any agent that supports delegated subtasks). GitHub exploration generates a lot of intermediate output — file trees, code snippets, API responses — that is useful for answering the question but clutters the main conversation. Delegating to a subagent keeps that noise isolated and returns only the synthesized answer.
Follow a broad-then-narrow approach:
gh repo view) and file tree to understand project shapeRun independent operations in parallel whenever possible. For example, read multiple files at once, or search code while listing a directory. When exploring unfamiliar territory, adjust your investigation based on what you discover — do not follow a rigid script.
gh repo view — get overview, default branch, languagesgh api .../git/trees/BRANCH?recursive=1 — get file treegh search code — find specific patterns or implementationsgh issue list / gh pr list with filtersgh issue view / gh pr view for detailsgh pr diff for code changesgh release list — recent releasesgh api .../compare/TAG1...TAG2 — diff between releases--json + --jq for structured, token-efficient outputhead -N to avoid flooding context[src/auth.rs](https://github.com/OWNER/REPO/blob/BRANCH/src/auth.rs#L10-L25)gh api -H "Accept: ..." --cache 1h for cacheable requests~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.