Aggregate GitHub security alerts into a single markdown report.
npx skills add https://github.com/gobifrost/bifrost --skill bifrost-secaudit
Please help me install this Agent Skill. Skill: bifrost-secaudit Source: https://github.com/gobifrost/bifrost/tree/main/.claude/skills/bifrost-secaudit Command: npx skills add https://github.com/gobifrost/bifrost --skill bifrost-secaudit
Manually checking multiple sections of the GitHub Security tab to get a full picture of a repository's security posture is time-consuming and prone to missing critical items. This Skill eliminates that friction by aggregating all relevant security data into a single, scannable markdown report.
Invoke the bifrost-secaudit skill to generate a complete read-only security posture snapshot report for the gobifrost/bifrost repository.
High-intent search queries and answers about installing and using this skill.
To aggregate GitHub security alerts into a single report, this Skill paginates through CodeQL alerts, cross-references Dependabot alerts with open PRs, and validates secret scanning and branch protection metrics into one scannable markdown file. It eliminates manual cross-checking of multiple dashboards.
The best way to triage CodeQL and Dependabot alerts is running a read-only security posture check that groups Dependabot PRs by auto-merge eligibility and flags high-severity items needing immediate action. This provides an instant snapshot of all outstanding security tasks.
Yes, you can check branch protection and auto-merge workflow health because the security audit validates core security workflow health metrics including auto-merge success rates and branch protection configuration. It retrieves this data directly from the GitHub Security tab.
The repository security snapshot does not modify repository settings or alerts because it performs a strictly read-only, non-destructive audit of your repository's security posture. It safely paginates high-volume CodeQL alerts without altering any existing data.
To generate a compliance report for your GitHub repository security posture, invoke this Skill to pull data from Dependabot, CodeQL, secret scanning, and Scorecard into one markdown report. It supports scheduled compliance reporting workflows.
Manually checking the GitHub Security tab misses critical vulnerabilities because it requires navigating multiple disconnected dashboards for Dependabot, CodeQL, and secret scanning. Aggregating these into a unified report prevents oversight and flags items needing immediate action.
shellicarConfigure GitHub repository settings and enforce branch protection rules via the gh CLI.
gobifrostAutomate triage and resolution of GitHub security artifacts for Bifrost.
castrojoConfigure the OpenSSF Scorecard GitHub Action for automated supply-chain security scoring.
paulinghamAutomate investigation and remediation of open GitHub CodeQL and secret-scanning alerts.
