Is github-repo-deploy safe to install?

SaferSkills independently audited github-repo-deploy (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

github-repo-deploy/SKILL.md · 1 file

github-repo-deploy/SKILL.md1.3 KB · Markdown

name: github-repo-deploy

description: Reconcile a YAML catalog of GitHub repo metadata (description, homepage, topics) to the live GitHub account. Idempotent, --dry-run by default, --apply --prod for the live PATCH. Auth via `gh auth token` or GITHUB_TOKEN env. Refuses to change visibility (public/private) or default_branch without explicit override. Use when the user says "polish my repos", "update GitHub descriptions", "tag my repos for discoverability", "fix repo metadata", or before any campaign that drives traffic to GitHub. Single-command alternative to clicking through every repo's settings page.

github-repo-deploy

YAML → GitHub repo metadata reconciler. Same pattern as stripe-sync and cloudflare-dns-deploy.

Usage

python3 github_repo_deploy.py                       # dry-run (read-only)
python3 github_repo_deploy.py --apply --prod        # reconcile live
python3 github_repo_deploy.py --repo aria-skills    # one repo

Config

See github_repos.yaml. Each entry can declare: name, description, homepage, topics.

Safety

`description` / `homepage` / `topics` — reconciled.
`private` — refuses to flip without --allow-visibility (not implemented; deliberate).
`default_branch` — warn-only, never auto-flipped.

License

Apache 2.0

github-repo-deploy— agent skill

Is github-repo-deploy safe to install?

github-repo-deploy

Usage

Config

Safety

License

Audit the pieces. Scan the whole. Decide.