Run any Skill in Manus with one click

repo-audit

Stars1

Forks0

UpdatedJuly 21, 2026 at 21:20

Audits a GitHub repository against a professional open-source checklist - README quality, metadata, community files, intake templates, protections, activity - and returns a scored gap report with prioritized fixes. Use when the user asks to audit, health-check, or score their repo, or asks what's missing before going public. Not for fixing a single named file or code-level security audits.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

Paldom

Paldom/github-skills

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

File Explorer

4 files

SKILL.md

readonly

name	repo-audit
description	Audits a GitHub repository against a professional open-source checklist - README quality, metadata, community files, intake templates, protections, activity - and returns a scored gap report with prioritized fixes. Use when the user asks to audit, health-check, or score their repo, or asks what's missing before going public. Not for fixing a single named file or code-level security audits.
license	MIT
argument-hint	["owner/repo (defaults to current repo)"]

repo-audit

The composite view: measures a repository against the professional-OSS bar and says what to fix first and which skill fixes it. The failure this skill fixes: ad-hoc audits that check whatever comes to mind, miss whole categories (metadata, protections), and produce unprioritized nag-lists that ignore project stage.

When NOT to use

The user names the fix ("write a README", "add topics", "protect main") → route straight to the focused skill; don't audit first.
Code-level bug hunting or PR security review → code-review work, not repo setup.
CI pipeline debugging → out of scope (CI presence is in scope).

Workflow

Collect evidence mechanically — no vibes:
```
python3 "${CLAUDE_SKILL_DIR}/scripts/collect_evidence.py" [owner/repo] > /tmp/repo-evidence.json
```
Gathers: repo metadata (gh repo view --json), community-profile health percentage, file presence (README/LICENSE/health files/templates/workflows), protections and security settings, releases, archive status, latest CI run. Every value is tri-state — null means not determinable (permissions, plan limits), and the JSON's not_collected list names checks that are manual or agent-judged by design.
Score with references/audit-checklist.md: six categories, each with weighted checks — README quality, discoverability, community health files, contribution intake, protections, vital signs. Compute per-category scores and the overall grade (A ≥90 … D). Checks answered by evidence fields score mechanically; checks in not_collected are scored by you reading the repo (say so in the report) or marked "manual review required" — never inferred from silence, and null evidence is always reported as unknown, not failing.
Right-size before reporting. Apply the checklist's stage rules: a solo hobby repo is not graded down for missing GOVERNANCE or elaborate templates — mark those "deferred by stage", not failing. Non-negotiables at every stage: LICENSE, README basics, no leaked secrets.
Report (template in the checklist): per-category score table, overall grade, then the top-5 prioritized fixes, each with impact, effort, and the owning skill (readme-author, repo-discoverability, community-health, issue-pr-templates, repo-protections; documentation-set or docs-site gaps → docs-author / docs-site).
Going-public pre-flight (when asked "before I make it public"): add the flip-specific blockers — license present (evidence-backed), PVR to enable right after the flip, social preview ready, plus two MANUAL blockers the evidence never covers: a secret scan of the full git history (gitleaks/trufflehog) and a personal/private-file review. List those two as unchecked boxes the maintainer must do — never present them as passed. Split blockers from nice-to-haves.
Fix nothing unasked. Offer to run the owning skill for the top items.

Output spec

A report containing: evidence-backed per-category scores, an overall grade, a top-5 fix list with owner-skill routing, stage-deferred items clearly marked, and zero modifications to the repository.

Gotchas

Some evidence needs permissions: traffic stats need push access; protections and security flags can 403 on private/free plans — the script degrades to "unknown"; report unknowns as unknowns, never as failures.
The community-profile health percentage only counts public-repo files — on private repos rely on the file-presence checks instead.
Don't chase 100/100: the checklist encodes diminishing returns; say when a repo is already past the bar its stage needs.
One audit per repo per conversation — re-run only after fixes land.

Files

references/audit-checklist.md — the six-category weighted checklist, scoring rubric, stage rules, report template.
scripts/collect_evidence.py — mechanical evidence collector (gh + filesystem), JSON to stdout; exits non-zero only when the target repo can't be read.

More from this repository

same repository

add-skill

Paldom/github-skills

Authors or improves an Agent Skill in this repo via the eval-first workflow - scope one purpose, write trigger evals, draft SKILL.md, validate, iterate. Use when the user asks to create, add, write, refine, or fix a skill ("add a skill for X", "improve triggering of Y"). Not for scaffolding a new repository or editing infrastructure (hooks, CI, the validator/scripts, docs).

2026-07-221

publish-repo

Paldom/github-skills

Publishes this Agent Skills repository to skills.sh - pre-flight checks, public visibility flip, protections (PVR, ruleset), consumer-style install verification, telemetry seeding, and repo-page groupings. Use when the user asks to publish, deploy, release, go public, or get listed on skills.sh. Not for authoring skills or editing scaffold infrastructure.

2026-07-221

docs-author

Paldom/github-skills

Plans, writes, or restructures project documentation - Diátaxis structure (tutorials, how-to guides, reference, explanation), minimal doc set, runnable examples, README-to-docs graduation, drift prevention. Use when the user asks to write, improve, or reorganize docs, guides, or tutorials. Not for the README itself, deploying a docs site, or community files.

2026-07-211

docs-site

Paldom/github-skills

Stands up, deploys, or fixes a documentation site on GitHub Pages - generator choice (MkDocs, Sphinx, Docusaurus, Starlight), the official Actions workflow, base-path/.nojekyll/custom-domain pitfalls, docs CI, versioning. Use for publishing docs to github.io or debugging a broken/unstyled Pages deploy. Not for writing the docs content, the README, or branch protections.

2026-07-211

readme-author

Paldom/github-skills

Writes, restructures, or syncs a professional GitHub project README - front-loaded value prop, minimal badges, copy-pasteable quick start, scannable structure for a library, CLI, or web app. Use when the user asks to write, improve, restructure, or review a README, or calls it bloated, stale, or outdated. Not for repo topics/social-preview, community files, profile READMEs, or docs sites.

2026-07-211

name	repo-audit
description	Audits a GitHub repository against a professional open-source checklist - README quality, metadata, community files, intake templates, protections, activity - and returns a scored gap report with prioritized fixes. Use when the user asks to audit, health-check, or score their repo, or asks what's missing before going public. Not for fixing a single named file or code-level security audits.
license	MIT
argument-hint	["owner/repo (defaults to current repo)"]

repo-audit

When NOT to use

The user names the fix ("write a README", "add topics", "protect main") → route straight to the focused skill; don't audit first.
Code-level bug hunting or PR security review → code-review work, not repo setup.
CI pipeline debugging → out of scope (CI presence is in scope).

Workflow

Collect evidence mechanically — no vibes:
```
python3 "${CLAUDE_SKILL_DIR}/scripts/collect_evidence.py" [owner/repo] > /tmp/repo-evidence.json
```
Gathers: repo metadata (gh repo view --json), community-profile health percentage, file presence (README/LICENSE/health files/templates/workflows), protections and security settings, releases, archive status, latest CI run. Every value is tri-state — null means not determinable (permissions, plan limits), and the JSON's not_collected list names checks that are manual or agent-judged by design.
Score with references/audit-checklist.md: six categories, each with weighted checks — README quality, discoverability, community health files, contribution intake, protections, vital signs. Compute per-category scores and the overall grade (A ≥90 … D). Checks answered by evidence fields score mechanically; checks in not_collected are scored by you reading the repo (say so in the report) or marked "manual review required" — never inferred from silence, and null evidence is always reported as unknown, not failing.
Right-size before reporting. Apply the checklist's stage rules: a solo hobby repo is not graded down for missing GOVERNANCE or elaborate templates — mark those "deferred by stage", not failing. Non-negotiables at every stage: LICENSE, README basics, no leaked secrets.
Report (template in the checklist): per-category score table, overall grade, then the top-5 prioritized fixes, each with impact, effort, and the owning skill (readme-author, repo-discoverability, community-health, issue-pr-templates, repo-protections; documentation-set or docs-site gaps → docs-author / docs-site).
Going-public pre-flight (when asked "before I make it public"): add the flip-specific blockers — license present (evidence-backed), PVR to enable right after the flip, social preview ready, plus two MANUAL blockers the evidence never covers: a secret scan of the full git history (gitleaks/trufflehog) and a personal/private-file review. List those two as unchecked boxes the maintainer must do — never present them as passed. Split blockers from nice-to-haves.
Fix nothing unasked. Offer to run the owning skill for the top items.

Output spec

A report containing: evidence-backed per-category scores, an overall grade, a top-5 fix list with owner-skill routing, stage-deferred items clearly marked, and zero modifications to the repository.

Gotchas

Some evidence needs permissions: traffic stats need push access; protections and security flags can 403 on private/free plans — the script degrades to "unknown"; report unknowns as unknowns, never as failures.
The community-profile health percentage only counts public-repo files — on private repos rely on the file-presence checks instead.
Don't chase 100/100: the checklist encodes diminishing returns; say when a repo is already past the bar its stage needs.
One audit per repo per conversation — re-run only after fixes land.

Files

references/audit-checklist.md — the six-category weighted checklist, scoring rubric, stage rules, report template.
scripts/collect_evidence.py — mechanical evidence collector (gh + filesystem), JSON to stdout; exits non-zero only when the target repo can't be read.