public-repo-maturity
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed to help repository owners improve their security posture by adopting OpenSSF Scorecard checks and earning CII Best Practices badges.
- [SAFE]: Instructions correctly emphasize pinning GitHub Actions to immutable commit SHAs instead of mutable tags, which is a critical defense against supply-chain attacks.
- [SAFE]: The skill promotes the use of Sigstore/Cosign for keyless signing of release artifacts, which enhances release integrity without requiring the management of sensitive private keys in CI secrets.
- [SAFE]: Templates provided for Dependabot configuration, Scorecard workflows, and Security Policies follow established security best practices and official documentation.
- [SAFE]: Guidance on GitHub Actions permissions explicitly advocates for the principle of least privilege, recommending that write permissions be isolated to specific publishing jobs while keeping test environments read-only.
Audit Metadata