github-health-claude-skills

Audit the full health of a GitHub repository. Triggers on /github-health commands and on natural-language requests like "check this repo", "is this PR safe to merge", "is this repo ready to release", or "audit security/CI/branches/Linear sync of this GitHub project". Routes to specialized sub-skills based on requested scope. Read-only by default; destructive actions require explicit user approval.

Audit Dependabot alerts and PRs in a GitHub repository: severity counts, affected packages, manifest and lockfile coverage, malware alerts, and version-update versus security-update configuration. Use this for vulnerability alerts and Dependabot PR backlogs; for the dependency tree itself use github-health-dependency-graph. Triggers on `/github-health dependabot <repo>` and requests like "what Dependabot alerts are open", "review vulnerable dependencies", or "is Dependabot configured". Read-only; never dismisses alerts or merges PRs.

Run an end-to-end health audit of a GitHub repository covering main branch, Actions, pull requests, branches, issues, security alerts, dependencies, documentation, releases, permissions, and Linear sync. Triggers on `/github-health full <repo>`, `/github-health standard <repo>`, `/github-health deep <repo>`, `/github-health quick <repo>` for a quick subset, and requests like "audit the whole repo" or "give me a complete health check". Read-only; destructive recommendations are approval-gated.

Apply score-improving changes to a GitHub repository based on the latest GitHub Health Report. Triggers on /github-health-improve commands and on natural-language requests like "raise this repo's health score", "apply the next improvement", "ratchet up the score". Reads the most recent saved report, picks the next highest-leverage improvement, optionally applies it on a non-main branch, opens a PR, and (when explicitly enabled) merges and re-audits. Approval-gated by default. Hard-stops on any red Action, conflict, secret detection, or destructive-operation requirement.

Run an umbrella security audit for a GitHub repository aggregating code scanning, Dependabot, secret scanning, malware alerts, repository security settings, SECURITY.md, and workflow permissions into one view. Use when the user wants the whole security picture; for a single dimension use child skills such as github-health-code-scanning, github-health-dependabot, or github-health-secret-scanning. Triggers on `/github-health security <repo>` and requests like "is this repo secure", "audit security posture", or "what is our security debt". Read-only; never dismisses alerts or changes settings without explicit approval.

Audit GitHub branch hygiene: merged branches, stale branches, orphan branches, branches behind main, branch naming risks, and branch cleanup candidates. Triggers on `/github-health branches <repo>` and requests like "review branches", "which branches can I delete", "branch cleanup", or "are there stale branches". Use this for branch-only cleanup; for cross-cutting cleanup (branches + PRs + issues + docs + security + Linear) use github-health-cleanup-plan instead. Read-only; never deletes branches without explicit approval.

Produce a safe, approval-gated multi-area cleanup plan for a GitHub repository covering branches, stale PRs, stale issues, documentation updates, security follow-ups, and Linear synchronization. Use this for cross-cutting cleanup; for branches-only cleanup use github-health-branches. Triggers on `/github-health cleanup-plan <repo>` and requests like "give me a cleanup plan" or "what should I tidy up across the repo". Read-only; every destructive step is explicitly approval-gated.

Audit CodeQL and other code scanning alerts in a GitHub repository: open alerts by severity, dismissed alerts with reasons, false-positive handling, and remediation tracking. Triggers on `/github-health code-scanning <repo>` and requests like "review CodeQL findings", "what SAST alerts are open", or "audit static-analysis results". Read-only; never dismisses alerts.

Audit the structural dependency tree of a GitHub repository: manifest and lockfile coverage, transitive dependency depth, abandoned or unmaintained packages, license signals, and SBOM readiness. Use this for what is in the dependency tree; for vulnerability alerts in those packages use github-health-dependabot. Triggers on `/github-health dependency-graph <repo>` and requests like "review our dependency tree", "any abandoned packages", "do we have an SBOM", or "is the lockfile current". Read-only; never modifies manifests or lockfiles.

Audit GitHub issues: backlog size, label hygiene, milestones, stale issues, duplicates, missing prioritization, and bug-report quality. Triggers on `/github-health issues <repo>` and requests like "review the backlog", "are issues being triaged", or "what issues are stale". Read-only; never closes issues without explicit approval.

Audit the set of open pull requests in a GitHub repository: mergeability, checks, reviews, conflicts, staleness, and traceability to issues or Linear. Triggers on `/github-health pulls <repo>` and requests like "review my open PRs", "what PRs are stuck", or "audit the PR backlog". For a single-PR readiness check, use `/github-health pre-merge` instead. Read-only; never merges or closes PRs without explicit approval.

Audit tags, releases, changelog alignment, versioning consistency, release notes quality, artifacts, and release-history hygiene. Triggers on `/github-health releases <repo>` and requests like "is our release process clean", "review release history", or "is the changelog aligned with tags". For a full release-readiness check today (a composite of full + releases + security context), use `/github-health release-readiness <repo>` instead. Read-only; never creates, edits, or deletes releases or tags.

Audit secret scanning alerts, bypasses, leaked credentials, .env hygiene, and workflow secret exposure in a GitHub repository. Triggers on `/github-health secret-scanning <repo>` and requests like "any leaked secrets", "review exposed tokens", or "audit secret hygiene". Read-only; never dismisses alerts or rotates secrets.

Audit GitHub Actions workflows, recent runs, required status checks, flake hints, action pinning, and workflow permissions. Triggers on /github-health actions <repo> and on requests like "are my Actions healthy", "why is CI flaky", "are workflow permissions least privilege". Read-only; never enables, disables, or runs workflows on its own.

Audit project documentation — README, SECURITY, ROADMAP, CONTRIBUTING, CHANGELOG, CODEOWNERS, issue and PR templates, and freshness signals. Triggers on /github-health docs <repo> and on requests like "is the README current", "do we have CONTRIBUTING", "audit our documentation". Read-only; never edits docs.

Audit synchronization between GitHub and Linear — PR/ticket alignment, status drift, roadmap drift, security follow-ups, and auto-close risks. Treats GitHub as the technical source of truth and Linear as the operational source of truth. Triggers on /github-health linear <repo> and on requests about Linear sync, roadmap drift, or PR/ticket traceability. Read-only; never modifies Linear records.

Audit collaborators, teams, GitHub Apps, webhooks, environment protections, token permissions, and least privilege. Triggers on /github-health permissions <repo> and on requests like "audit access", "who has push", "are tokens least privilege". Read-only; never modifies access or settings.