repo-security-posture

Name: repo-security-posture
Availability: InStock
Author: Superagent

Inventory GitHub repository security posture across branch protection, actions, and access controls.

76|11|Updated May 18, 2026

Search Tags:#vulnerability #github #supply-chain #ci-cd #security-audit #codeowners #branch-protection

Ready to run

npx skills add https://github.com/superagent-ai/skills --skill repo-security-posture

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: repo-security-posture
Source: https://github.com/superagent-ai/skills/tree/main/skills/repo-security-posture
Command: npx skills add https://github.com/superagent-ai/skills --skill repo-security-posture

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps security engineers and developers quickly surface gaps in a GitHub repository's security posture by collecting and summarizing critical configuration and policy data across branch protection, CODEOWNERS, GitHub Actions, vulnerability alerts, environments, collaborators, and deploy keys.

Core Features & Use Cases

Identify misconfigurations in branch protection, CODEOWNERS, and Actions to reduce risk exposure.
Produce a ranked hardening todo list with concrete remediation steps tailored to the target repository.
Use on-demand during repo security reviews or as part of a maintenance sprint to harden governance and supply-chain controls.

Quick Start

Run the repo-security-posture collector against a target repository to generate a structured inventory and actionable hardening recommendations.

Frequently Asked Questions about repo-security-posture

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit a GitHub repository's security posture?▼

To audit a GitHub repository's security posture, the skill collects metadata across branch protection, CODEOWNERS, Actions, vulnerability alerts, environments, collaborators, and deploy keys to produce a ranked hardening todo list.

What is GitHub branch protection and why does it matter for security?▼

Branch protection is a GitHub feature that enforces review and status checks before merging. It matters for security because misconfigurations increase risk exposure, which is why posture audits assess these rules.

Can I check vulnerability alerts without admin access to the repository?▼

You can check vulnerability alerts and other publicly readable metadata without admin access. When admin-gated endpoints are inaccessible, the audit gracefully marks those settings as not_verified and provides guidance to re-run with proper access.

What's the best way to harden GitHub Actions and supply-chain controls?▼

The best way to harden GitHub Actions and supply-chain controls is to run a security posture audit that identifies misconfigurations and generates a tailored, ranked hardening todo list with concrete remediation steps for the target repository.

Why does my security audit mark repository settings as not_verified?▼

A security audit marks repository settings as not_verified when it lacks the admin token required to access gated endpoints. It gracefully handles this by providing guidance to re-run the audit with proper access.