github-as-db 100/100 — SaferSkills

Is github-as-db safe to install?

SaferSkills independently audited github-as-db (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/github-as-db/SKILL.md · 1 file

skills/github-as-db/SKILL.md1.4 KB · Markdown

name: github-as-db

description: >

Use a GitHub repo as a zero-infra, anonymous-friendly data store — JSON files as records,

GitHub App bot as the write layer, build-time index compilation as the read layer.

No auth service, no database, no backend required. Covers CRUD via Octokit, community

contribution via PR flow, and build-time index generation to avoid API rate limits.

Use when building community data repos, personal low-frequency data stores, open-source

projects that need structured data without a database, or any "submit to repo" feature

from a browser app where users don't need a GitHub account.

when_to_use: >

User wants to store or contribute structured data to a GitHub repo from a browser app.

Also use when: setting up GitHub App installation token auth in a Vite/browser context,

implementing a PR-based contribution flow, asking about repo-as-database architecture,

looking for a free zero-infra alternative to a database for OSS or personal projects,

or hitting GitHub API rate limits when reading many files.

allowed-tools:

- Read

- Write

- Edit

- Bash

Read @/knowledge/github/github-as-db.md and apply the full pattern: architecture overview, GitHub App setup, browser-side JWT + installation token, full CRUD operations, build-time index compilation (and why it's needed), PR-based community contribution flow, and all gotchas.

github-as-db— agent skill

Is github-as-db safe to install?

Audit the pieces. Scan the whole. Decide.