repo-audit
Run a read-only audit of every catalog skill's checks against a repository and report which setup gaps exist. Runs a bundled Python script from the repository root, prints one row per catalog skill (check, status, evidence, the skill that fixes it), then proposes an ordered plan naming those skills. Never writes a file and never calls a mutating GitHub API endpoint, even with the optional --github flag, which adds read-only GET checks. Use when the user says "audit this repo", "what's missing in this repository", "repo health check", "which setup skills apply", or invokes /repo-audit. Do NOT use for applying any fix directly — route each finding to its catalog skill — or for code review of application logic.
- Installs
- 53
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/paulnsorensen/git-gouda --skill repo-audit- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads repo-audit automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
repo-audit
A read-only survey of a repository against every other catalog skill's setup checks. It answers one question: which catalog skills apply here, and in what order?
What this skill is NOT for
- Applying a fix — a finding routes to the skill that owns it (
oss-hygiene,gh-bootstrap, and so on); this skill never edits a file or calls a mutating API. - Code review of application logic, tests, or business behavior — out of scope.
- Replacing a catalog skill's own protocol — the audit is a triage pass, not a substitute for reading that skill's
SKILL.md.
Protocol
1. Run the bundled script from the repository root
python3 skills/repo-audit/scripts/repo_audit.py
Add --github to also run read-only gh api GET calls (merge settings, rulesets, delete_branch_on_merge, the CODEOWNERS errors endpoint). --github is opt-in; the default run only reads the working tree and local git metadata (git tag --list, git remote get-url origin).
Use --json for machine consumption or --markdown to paste the table into a PR comment. The script always exits 0 unless it errors itself — a missing or warn row is not a script failure.
2. The script checks, read-only, one row per catalog skill
| Check | What it inspects | Route to |
|---|---|---|
| prek | prek.toml or .pre-commit-config.yaml | prek |
| oss-hygiene | LICENSE, CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md, .github/ISSUE_TEMPLATE, PULL_REQUEST_TEMPLATE, .github/dependabot.yml, plus scorecard/codeql/dependency-review workflow presence | oss-hygiene |
| gh-bootstrap | .github/release.yml; with --github also merge settings and non-empty rulesets | gh-bootstrap |
| safe-settings | .github/settings.yml (informational) | safe-settings |
| config-review-bot | .coderabbit.yaml | config-review-bot |
| release | git tag --list and CHANGELOG.md | release |
| justfile | justfile | justfile |
| ci-optimize | workflows present with concurrency: (informational) | ci-optimize |
| build-optimize | skipped — needs measured wall-time data | build-optimize |
| github-copilot-repo-instructions | .github/copilot-instructions.md or .github/instructions/*.instructions.md | github-copilot-repo-instructions |
| codeowners | CODEOWNERS in root, docs/, or .github/; with --github also the codeowners/errors endpoint | codeowners |
| actions-pinning | count of uses: refs not pinned to a 40-hex commit SHA | actions-pinning |
| pr-title-lint | a workflow containing action-semantic-pull-request or commitlint | pr-title-lint |
| labels-as-code | .github/labels.yml or .github/labeler.yml | labels-as-code |
| repo-attributes | .gitattributes, .editorconfig, .gitignore | repo-attributes |
| branch-cleanup | with --github, delete_branch_on_merge | branch-cleanup |
| agents-md | AGENTS.md exists, under 32 KiB, under about 200 lines | agents-md |
Each row's status is pass, warn, missing, or skipped. skipped means the check needs data this script cannot gather statically (build-optimize) or needs --github and it was not passed (branch-cleanup), not that the repository failed the check.
3. Read the table and propose an ordered plan
After the script prints its table, read the missing and warn rows and propose an ordered plan that names the catalog skill for each gap. Order gaps by dependency where one exists (for example, gh-bootstrap locks the merge surface before oss-hygiene adds contributor-facing files; actions-pinning matters more once workflows exist). Do not apply any fix yourself — hand each gap to its named skill.
4. No writes, no mutating calls
This skill and its script never create, edit, or delete a file, and never call a POST, PATCH, PUT, or DELETE GitHub API endpoint. --github only adds GET calls. If a user asks the audit to "just fix it", decline and restate the routing plan from step 3 instead.
References
references/checks.md— one row per check, the file or endpoint it inspects, and a docs.github.com citation where an API is used.
FAQ
What does the repo-audit skill do?
Run a read-only audit of every catalog skill's checks against a repository and report which setup gaps exist. Runs a bundled Python script from the repository root, prints one row per catalog skill (check, status, evidence, the skill that fixes it), then proposes an ordered plan naming those skills. Never writes a file and never calls a mutating GitHub API endpoint, even with the optional --github flag, which adds read-only GET checks. Use when the user says "audit this repo", "what's missing in this repository", "repo health check", "which setup skills apply", or invokes /repo-audit. Do NOT use for applying any fix directly — route each finding to its catalog skill — or for code review of application logic.
How do I install repo-audit?
Run npx skills add https://github.com/paulnsorensen/git-gouda --skill repo-audit in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/repo-audit/ (personal) or .claude/skills/repo-audit/ (project).
Which AI agents can use repo-audit?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is repo-audit safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains repo-audit?
It is published by paulnsorensen in paulnsorensen/git-gouda. It has 53 recorded installs.
More from paulnsorensen/git-gouda
safe-settings
paulnsorensen/git-gouda
Set up GitHub's safe-settings (a Probot-based GitHub App from the github org) for declarative, org-wide repository policy as code. Use when the user says "settings as code", "safe-settings", "manage repos declaratively", "centralize repo settings", "org-level branch protection", "scaffold an admin repo", "github settings app", or invokes /safe-settings on an org that wants to manage repo settings, branch protection, rulesets, labels, teams, environments, and collaborators from one admin repo. Scaffolds the admin-repo layout (settings.yml + suborgs/ + repos/), the GitHub App installation steps, and a scheduled full-sync GitHub Actions workflow. Distinct from /gh-bootstrap (one-shot gh api config of a single repo) — this skill is for org-scale settings as code that reconciles continuously. Not for per-task GitHub ops (PRs, issues, CI status) or local git work — those are out of this catalog's scope.
config-review-bot
paulnsorensen/git-gouda
Audit or configure CodeRabbit repository review policy from effective sources. Use for CodeRabbit setup, configuration review, path coverage, or a specific pull-request review audit. Trigger on "configure CodeRabbit", "review .coderabbit.yaml", "set up CodeRabbit", "audit CodeRabbit settings", or "is CodeRabbit covering X". Keep audits read-only by default and separate schema validity, rule quality, and completed-review evidence. Do not use it to run a CodeRabbit CLI review or autofix, or to fix review comments on a pull request.
oss-hygiene
paulnsorensen/git-gouda
Bring an open-source GitHub repository up to community-standards and supply-chain hygiene baseline: scaffold the GitHub Community Standards files (README check, LICENSE, CODEOFCONDUCT, CONTRIBUTING, SECURITY, issue + PR templates), wire Dependabot version updates, the Dependency Review action, OpenSSF Scorecard, and CodeQL (when applicable), check Dependabot alerts and secret scanning, and add the OpenSSF Best Practices Badge link. Use when the user says "set up OSS hygiene", "make this repo open-source-ready", "add community health files", "wire dependabot", "add scorecard", "OSSF badge", "supply chain hardening", or invokes /oss-hygiene on a public repo. Idempotent — safe to re-run; diffs against templates and asks before overwriting. Distinct from /gh-bootstrap (merge-button + branch protection) and /safe-settings (org-scale settings as code): focuses on the contributor-facing and supply-chain surface, not merge or org policy. Run after /gh-bootstrap; before announcing the repo.
prek
paulnsorensen/git-gouda
Onboard prek (Rust-powered pre-commit) into any project and suggest hooks tailored to the language/framework. Use when the user says "add prek", "set up pre-commit hooks", "configure prek", "what hooks should I use", or when you notice a project without a prek.toml that would benefit from pre-commit checks. Also trigger when the user wants to add new hooks to an existing prek.toml, audit their hook config, or migrate from pre-commit to prek. Covers Rust, Python, TypeScript/JavaScript, Go, Ruby, and Shell projects. Do NOT use for husky, lint-staged, or CI pipeline hook configuration — this skill is specifically for prek.
gh-bootstrap
paulnsorensen/git-gouda
One-time GitHub repository configuration via the gh CLI: lock the default branch with PR and CI rules, optionally enable a supported merge queue, lock merging to squash-only with PR-title commit messages, scaffold automatically-generated release notes (.github/release.yml), and optionally add a tag-driven release workflow. Use when the user says "set up the repo", "configure the merge queue", "enable squash merging", "lock down main", "set up branch protection", "configure release notes", "scaffold releases", "set up release tagging", or invokes /gh-bootstrap on a fresh or loosely-configured GitHub repository. Idempotent — safe to re-run on already-configured repos to bring missing pieces in line. This skill covers one-time repo policy, not per-task GitHub operations, local git commands, or project task running.
github-copilot-repo-instructions
paulnsorensen/git-gouda
Add, audit, or fix GitHub Copilot repository custom instructions — .github/copilot-instructions.md (repo-wide) and .github/instructions/.instructions.md (path-specific) — so Copilot Chat, Copilot code review, and the Copilot coding agent all pick up project-wide guidance. Also covers AGENTS.md, CLAUDE.md, and GEMINI.md as alternate agent instruction files. Use when the user says "add Copilot instructions", "set up copilot-instructions.md", "audit our Copilot config", "make Copilot follow our conventions", "configure Copilot code review", "add path-specific Copilot rules", "applyTo glob", "excludeAgent", "Copilot is ignoring our guidance", or invokes /github-copilot-repo-instructions. Do NOT use for personal (per-user) Copilot instructions; those are out of scope for this skill. For AGENTS.md authoring guidance beyond file layout, see the agents-md skill.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.