See it in action
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
PromptPlease scout https://github.com/private-developer/secret-tool and tell me its install steps.
What was checked, without and with the skill| Checked | Without skill | With skill |
|---|
| The response clearly states that public repository inspection constraints apply unless authenticated context is present. | Missed | Passed |
|---|
What's inside
The instructions your model reads when the skill loads.
SKILL.md53 linessingle file
GitHub Repo Scout
When to Use
- User says github.com or task matches this capability
- User says check this repo or task matches this capability
- User says scout repo or task matches this capability
- User says what is this project or task matches this capability
Workflow
- Parse owner/repo from URL; reject non-GitHub hosts unless user confirms.
- Fetch README and top-level tree via public API or git clone (read-only).
- Compare README claims vs actual committed files (note drift).
- Check if repo exists locally in workspace or common clone paths.
- Summarize: purpose, install steps, risks, suggested actions (clone, audit, review).
- Do not access private repos without authenticated user context.
Integrations
oss-repo-maintainer
defensive-mcp-audit
skill-rubric-reviewer
Error Handling
Gotchas
- Public repos only unless user has authenticated MCP/GitHub access.
Safety & Ethics (Publication-Ready)
This skill is designed for public distribution. Constraints:
- Read-only repository inspection.
- No harvesting of tokens, secrets, or private issue content.
Track record
Benchmark
17 / 21
test cases passed, vs 11 / 21 without
Adoption
- Users
- 0
- Times used
- 0
Safety and source details
SkillSafety
✓ 3 of 3 passed✓Code scan15 of 15 checks clean
0 critical · 0 warning · 0 info — scanner v5 — 8/15/2026
View 15 scanner checks
live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing
✓IntentSafe
LLM judge · does the skill do what it claims
✓ContentClean
LLM judge · policy & harmful-content review
Source
Importedstijnman / grok-custom-skills
.grok/skills/github-repo-scout/SKILL.md
View on GitHub ↗License MITImported 8/15/2026Version v2