repo-setup-review

Review GitHub repository security and compliance configurations using the gh CLI.

1|Updated Apr 29, 2026
One-click install
npx skills add https://github.com/sigmadigitalza/engineering-playbook --skill repo-setup-review
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: repo-setup-review
Source: https://github.com/sigmadigitalza/engineering-playbook/tree/main/plugins/sigma-engineering/skills/repo-setup-review
Command: npx skills add https://github.com/sigmadigitalza/engineering-playbook --skill repo-setup-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires gh, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill reviews and configures the setup of a GitHub repository, focusing on security and compliance with various posture configurations.

Core Features & Use Cases

  • Repo Configuration Review: Inspects branch and tag protection, CODEOWNERS, permissions, and more.
  • Posture Detection: Identifies whether the repo posture is open-source, distribution-only, private team, or personal.
  • Analysis Rubric: Provides a detailed analysis with actionable recommendations for improvements.

Quick Start

Review the setup of the GitHub repo using the repo-setup-review skill and provide the posture and findings.

Frequently Asked Questions about repo-setup-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is GitHub repo posture detection and why do I need it?

GitHub repo posture detection identifies whether your repository setup is open-source, distribution-only, private team, or personal. It helps determine the appropriate security baseline and compliance configurations needed for your specific repository type.

How do I set up branch protection rules and CODEOWNERS in GitHub?

Setting up branch protection rules and CODEOWNERS requires inspecting current repository configurations and applying security best practices. This Skill analyzes your current setup and provides actionable recommendations for configuring these security features properly.

Do I need the gh command-line tool to check repository security posture?

Yes, you need the gh command-line tool installed to check repository security posture. This Skill requires gh for GitHub API access to inspect branch protection, CODEOWNERS, permissions, and other compliance configurations.

What's the best way to audit GitHub repo permissions and security settings?

The best way to audit GitHub repo permissions and security settings is through a structured posture analysis. This Skill inspects branch protection, tag protection, CODEOWNERS, and permissions, then provides a detailed rubric with actionable improvement recommendations.

Can I use this repo configuration review for both private team and open-source repositories?

Yes, you can use this repo configuration review for both private team and open-source repositories. The Skill detects your specific posture—whether open-source, distribution-only, private team, or personal—and tailors the security and compliance recommendations accordingly.