building-github-index-a4f092 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited building-github-index-a4f092 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create markdown indexes of GitHub repositories optimized for Claude project knowledge. Indexes enable retrieval via GitHub API with semantic descriptions for effective matching.
# Documentation repos (markdown/notebooks)
python scripts/github_index.py owner/repo -o index.md
# Code repos (extract symbols via tree-sitter)
python scripts/github_index.py owner/repo --code-symbols -o index.md
# Multiple repos combined
python scripts/github_index.py owner/repo1 owner/repo2 -o combined.md| Flag | Description |
|---|---|
-o, --output | Output file (default: github_index.md) |
--token | GitHub PAT; also reads GITHUB_TOKEN env |
--include-patterns | Only index matching globs: "docs/**" "src/**" |
--exclude-patterns | Skip matching globs: "test/**" |
--max-files | Cap files per repo (default: 200) |
--skip-fetch | Tree only, no content fetch (fast, filename-only descriptions) |
--code-symbols | Include code files, extract function/class names via tree-sitter |
title: and description: fields--code-symbols)Some repos have stub files (links to external docs, empty readmes). In these cases:
Manual curation recommended. Use the tree output and domain knowledge:
# Get tree structure only (fast)
python scripts/github_index.py owner/repo --skip-fetch -o skeleton.md
# Then manually enhance descriptions based on domain knowledgeFor code-heavy repos with embedded apps:
acc_wav_gen → "ACC waveform generation"# {Repo} - Content Index
**Repository:** {url}
**Branch:** `{branch}`
## Retrieval Method
{API curl commands}
---
## {Category}
| Description | Path |
|-------------|------|
| {What this covers} | `{path/file.md}` |Description column leads (relevance matching), path follows (retrieval key).
Enumerate files:
curl -sL "https://api.github.com/repos/OWNER/REPO/git/trees/BRANCH?recursive=1"Fetch content:
curl -s "https://api.github.com/repos/OWNER/REPO/contents/PATH?ref=BRANCH" \
-H "Accept: application/vnd.github+json" | \
python3 -c "import sys,json,base64; print(base64.b64decode(json.load(sys.stdin)['content']).decode())"Allowlist: api.github.com, raw.githubusercontent.com
accessing-github-repos - Private repos, PAT setup, tarball downloadmapping-codebases - Detailed code structure (methods, imports, line numbers)For token-constrained project knowledge, use the condensed script:
python scripts/pk_index.py owner/repo -o repo_pk.mdProduces ~80% smaller output:
path — descriptionIdeal when adding multiple repo indexes to project knowledge.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.