audit-github-tokens

This Skill audits GitHub token usage by scanning all SKILL.md files to detect token usage patterns and map each skill's operations to required permission scopes. It generates a structured least-privilege report highlighting reduced scopes, unknown tools, and manual-review flags.

Yes, you can generate a governance-ready security report by scanning SKILL.md files to categorize risks and map scopes. The audit process strictly avoids modifying any files or tokens, ensuring a safe read-only review of your organization's GitHub token usage.

Mapping GitHub CLI calls to permission scopes involves scanning SKILL.md files for detected tools or gh CLI calls and known API patterns. These operations are then categorized by risk to surface safe, least-privilege recommendations per skill.

Yes, the GitHub token audit categorizes risks and scope needs specifically within the limitations of a repo-scoped token. It collects per-skill details such as repository, file path, and detected tools to ensure accurate permission mapping.

Least-privilege token scope limits GitHub access to only the permissions required for specific operations. You can check this organization-wide by inventorying token usage across SKILL.md files and classifying operations to generate safe scope recommendations.

To inventory GitHub token usage, scan all SKILL.md files in the organization to collect details like repo, file path, and detected API patterns. This classifies operations by type and flags unknown tools for manual security review.