repo-security-posture

To audit a GitHub repository's security posture, the skill collects metadata across branch protection, CODEOWNERS, Actions, vulnerability alerts, environments, collaborators, and deploy keys to produce a ranked hardening todo list.

Branch protection is a GitHub feature that enforces review and status checks before merging. It matters for security because misconfigurations increase risk exposure, which is why posture audits assess these rules.

You can check vulnerability alerts and other publicly readable metadata without admin access. When admin-gated endpoints are inaccessible, the audit gracefully marks those settings as not_verified and provides guidance to re-run with proper access.

The best way to harden GitHub Actions and supply-chain controls is to run a security posture audit that identifies misconfigurations and generates a tailored, ranked hardening todo list with concrete remediation steps for the target repository.

A security audit marks repository settings as not_verified when it lacks the admin token required to access gated endpoints. It gracefully handles this by providing guidance to re-run the audit with proper access.