Is gh-org-audit safe to install?

SaferSkills independently audited gh-org-audit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/gh-org-audit/SKILL.md · 1 file

skills/gh-org-audit/SKILL.md1.4 KB · Markdown

name: gh-org-audit

description: Audit one or more GitHub orgs for stale live repos, local clones of

archived repos, and repos missing standard files. Use when cleaning up the org,

doing a monthly review, or when something feels disorganized. Triggers on "audit

github", "audit the org", "org cleanup", "what repos are stale", "org health",

"github audit".

allowed-tools: Bash

gh-org-audit

Full health picture of your GitHub orgs: stale repos, missing files, archived repo clutter.

Tools

scripts/audit.sh

Audits all configured orgs and reports: stale live repos, archived repos with local clones, repos missing standard files.

Input: AUDIT_ORGS=<"orgname:~/local/path orgname2:~/local/path2"> - space-separated org:localpath pairs
Input: STALE_DAYS=<int> days since last push to consider stale (default: 90)
Output:

  {
    "orgs": {
      "<org1>": {stale, missing_standard_files, local_archived_clones},
      "<org2>": {...}
    },
    "summary": {live, archived, stale}
  }

Workflow

Determine the orgs and their local paths, then run:

AUDIT_ORGS="myorg:~/dev/projects" bash scripts/audit.sh

Report: stale repos first (most actionable), then missing standard files, then local archived clones
For each stale repo: suggest archive or note active reason
For each local clone of an archived repo: suggest removing the local dir
Do NOT delete anything without confirmation

gh-org-audit— agent skill

Is gh-org-audit safe to install?

gh-org-audit

Tools

scripts/audit.sh

Workflow

Audit the pieces. Scan the whole. Decide.