github-project — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited github-project (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
GitHub repository configuration, troubleshooting, and collaboration workflow best practices.
enforce_adminsREQUIRED post `gh repo create`:scripts/init-branch-protection.sh OWNER/REPO— seereferences/repo-bootstrap.md(closes snipe-it#17 class).
gh pr view PR --repo OWNER/REPO \
--json mergeStateStatus,reviewDecision,mergeable,reviewThreadsUse assets/pr-quality.yml.template for auto-approve with required_approving_review_count >= 1.
Requires allow_auto_merge, pull_request_target trigger, user.login bot detection, gh pr merge --auto with dynamic strategy. See references/auto-merge-guide.md.
gh pr view PR --repo OWNER/REPO --json autoMergeRequest --jq .autoMergeRequest
gh api repos/OWNER/REPO/branches/main/protection/required_pull_request_reviews \
--jq '.bypass_pull_request_allowances.apps[].slug'gh run list --repo OWNER/REPO --limit 5
gh run view RUN_ID --repo OWNER/REPO --log-failed
gh run rerun RUN_ID --repo OWNER/REPOgh api repos/OWNER/REPO/branches/main/protection \
--jq '{rcr: .required_conversation_resolution.enabled, admins: .enforce_admins.enabled}'
gh api repos/OWNER/REPO/code-scanning/default-setup --jq '.state'
gh pr view PR --repo OWNER/REPO --json reviewThreads --jq '.reviewThreads'See references/auto-merge-guide.md (signed-commit rebase fixes, workflow-file PRs, Copilot auto-approve race).
scripts/init-branch-protection.sh OWNER/REPO # baseline (post gh repo create)
scripts/init-branch-protection.sh OWNER/REPO --from-current-checks # after first CI
scripts/verify-github-project.sh /path/to/repository # local-checkout audit| Topic | Reference |
|---|---|
Repo bootstrap (post gh repo create) | references/repo-bootstrap.md |
| Repository file layout | references/repository-structure.md |
| Branch migration | references/branch-migration.md |
| Dependabot/Renovate | references/dependency-management.md |
| Auto-approve + auto-merge | references/auto-merge-guide.md |
| Merge strategy (signed commits) | references/merge-strategy.md |
| Sub-issues | references/sub-issues.md |
| Release labeling | references/release-labeling.md |
| gh CLI commands | references/gh-cli-reference.md |
| Polyglot CI checklists | references/repo-setup-guide.md |
| Scorecard, CodeQL, security | references/security-config.md |
| actionlint | references/actionlint-guide.md |
| Workflow bash pitfalls | references/workflow-bash-patterns.md |
| Fork merge base | references/pr-commit-cleanup.md |
| Multi-repo batch ops | references/multi-repo-operations.md |
| Reusable workflow security | references/reusable-workflow-security.md |
| Reusable workflow pitfalls | references/reusable-workflow-pitfalls.md |
| Org security settings | references/org-security-settings.md |
| Tag validation | references/tag-validation.md |
| AI reviewer pushback | references/ai-reviewer-pushback.md |
| Agentic workflows | references/agentic-workflows.md |
Contributing: https://github.com/netresearch/github-project-skill
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.