skills.rest
lukehinds
lukehindsCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

posture

Assess GitHub repository readiness for vulnerability reports via security policy checks.

Updated May 20, 2026
Search Tags:#security#vulnerability#github#reporting#hygiene#policy#posture
One-click install
npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill posture-lukehinds
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: posture
Source: https://github.com/lukehinds/scrutineer-attest-test/tree/main/skills/posture
Command: npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill posture-lukehinds

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Assess a repository's readiness to receive vulnerability reports by evaluating security policy, vulnerability reporting, and hygiene signals.

Core Features & Use Cases

  • Check for presence of a security policy and a defined contact point for disclosures.
  • Verify security-related signals such as .well-known/security.txt, private vulnerability reporting, prior advisories, and scanning/workflow indicators to derive a readiness tier.
  • Use as a pre-disclosure health check to guide maintainer onboarding and response expectations.

Quick Start

Run posture checks on the target repository to generate a readiness report.

Frequently Asked Questions about posture

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check a GitHub repository's readiness to receive vulnerability reports?▼

Assess a GitHub repository's vulnerability reporting readiness by checking its security policy, private reporting status, security.txt file, and code scanning workflows to derive a posture tier. The skill applies deterministic checks against public repository metadata to output a structured readiness report.

What security hygiene signals indicate a project is ready for vulnerability disclosures?▼

Security hygiene signals include a defined security policy, enabled private vulnerability reporting, a valid .well-known/security.txt file, prior advisories, and active code-scanning workflows. These indicators are evaluated to determine if a project has a defined contact point and process for handling disclosures.

Can I use this to perform a pre-disclosure health check before submitting a security report?▼

Yes, you can use this as a pre-disclosure health check to guide maintainer onboarding and response expectations. It evaluates public repository metadata and policy files to generate a structured readiness report with per-check evidence before you submit a vulnerability.

Does the posture assessment work on private GitHub repositories?▼

The posture assessment relies on public repository metadata and policy files. It applies deterministic checks across GitHub-hosted repositories and similar environments, but requires public access to evaluate security policy, vulnerability reporting, and hygiene signals.

What is included in the structured posture report output?▼

The structured posture report includes a derived readiness tier and per-check evidence. It verifies security-related signals such as .well-known/security.txt, private vulnerability reporting, prior advisories, and scanning indicators to provide a complete readiness assessment.

Related Skills

Explore More Software Engineering Skills→
liujiarui0918liujiarui0918

using-deepwiki

Analyze public GitHub repository structure and design rationale without cloning.

Community
Advanced
SignmanalSignmanal
1

oss-forensics

Investigate GitHub supply chain attacks and generate forensic reports.

Community
Advanced
BrunoSantanaDeveloperBrunoSantanaDeveloper

vulnerability-scanner

Scan codebases for dependencies, secrets, and insecure patterns.

Community
Advanced
adiytharpansaadiytharpansa

security-scanner

Identify security vulnerabilities in code, configurations, and systems with OWASP-aligned checks.

Community
Advanced