Analyze GitHub repository URLs for security risks and maintainer health.
npx skills add https://github.com/KerberosClaw/kc_ai_skills --skill repo-scan-kerberosclaw
Please help me install this Agent Skill. Skill: repo-scan Source: https://github.com/KerberosClaw/kc_ai_skills/tree/main/repo-scan Command: npx skills add https://github.com/KerberosClaw/kc_ai_skills --skill repo-scan-kerberosclaw
GitHub 開源專案安全掃描工具。輸入 GitHub repo URL，輸出專案概覽、靜態弱點分析、供應鏈風險、Issues 安全回報、維護者評估與風險總結。適用於安裝前的安全評估。
在終端機執行 /repo-scan https://github.com/owner/repo 即開始安全評估。
High-intent search queries and answers about installing and using this skill.
To audit a GitHub repository for security risks, you can scan the repo URL to receive a project overview, static weakness analysis, supply chain risks, and maintainer health evaluation without executing any code.
Checking open-source maintainer health and supply chain risks involves analyzing repository metadata and issue reports to evaluate maintainer activity and identify potential vulnerabilities in the project dependencies.
Yes, you need git and gh CLI installed to retrieve repository metadata and issue reports for a comprehensive security analysis, although the static checks themselves run without executing the project's code.
Yes, evaluating GitHub issues for security reports is possible by integrating issue retrieval with dependency audits to surface vulnerability reports and supply chain risks within the repository.
A limitation of running static analysis on a GitHub repository is that it assesses code weaknesses and supply chain risks without executing the code, meaning runtime vulnerabilities or dynamic execution issues are not captured in the output.
theZMCRead GitHub issue status, metadata, and comments via gh CLI.
alxayoDetect security misconfigurations and compliance violations in Infrastructure as Code.
robit-manAnalyze dependency integrity, build pipelines, and SBOM composition for supply chain security.
bugrabilgeDetect security vulnerabilities in code, running apps, and dependencies.
