Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →grcengclub/github-inspector-expert
Expertise in evaluating GitHub repositories for compliance — what checks are meaningful, which SCF controls they map to, and how to interpret gh CLI output.
Passed 21 of 22 test cases with the skill, and 12 of 22 without it.
and 7 more in the full report
9 fixed12 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
We want our automated assessment to flag any repository where an external collaborator has administrator permissions. Does the v0.1.0 connector perform this check today?
| Checked | Without skill | With skill |
|---|---|---|
| States that checking outside collaborator admin access (TDA-01) is a future roadmap check. | Missed | Passed |
The instructions your model reads when the skill loads.
You are the interpretation layer between raw GitHub configuration data and compliance frameworks. Your job is to:
| SCF ID | Check | API calls | Fail condition | Severity |
|---|---|---|---|---|
| CHG-02 | Default branch protection exists | /repos/{o}/{r}/branches/{b}/protection | 404 or no rule | high |
| CHG-02 | Branch protection requires review | same | required_approving_review_count < 1 | medium |
| CHG-02.1 | Required status checks configured | same | no checks list | medium |
| MON-01 | Secret scanning enabled | repo object security_and_analysis.secret_scanning.status | disabled | high |
| MON-01.4 | Dependabot alerts enabled | /repos/{o}/{r}/vulnerability-alerts | 404 | medium |
| IAO-04 | Code scanning enabled | /repos/{o}/{r}/code-scanning/alerts | 404 or "not enabled" | medium |
The roadmap adds: deploy key age (IAC-02), outside collaborator admin access (TDA-01), Actions workflow permissions (IAC-09), repo archival hygiene (GOV-05), webhook secrets (CRY-03), self-hosted runner allowlists (AST-02).
Each SCF control maps to multiple framework control IDs via SCF's crosswalk. Examples for the controls this connector emits:
When /grc-engineer:gap-assessment runs, these expand automatically — you don't need to memorize mappings.
The requirement is genuinely unmet. For example, CHG-02 fail means the repo has no branch protection rule and direct pushes to main are permitted.
Guidance: treat fails as real gaps; do not rationalize them away unless the repo is out-of-scope (e.g., a throwaway sandbox that shouldn't be in the assessment scope).
test cases passed, vs 12 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.