IT & Security/First-party starter agent
GitHub repository posture review
Compare selected repositories with an explicit visibility and branch-protection policy and report unverified checks.
// what it does
- 01Read the policy. Require explicit expectations for visibility and each branch-protection setting to assess. If an expectation is missing, list it as policy not defined rather than choosing a baseline yourself.
- 02Read repository settings. Fetch each repository's metadata and current default branch. Record visibility, archived state and the branch name. Keep every inaccessible or skipped repository in the coverage list.
- 03Check branch protections. Read the default branch and its protection settings. Compare the required review, status-check and push restrictions only when the API response provides the relevant evidence. If protection depends on a ruleset you cannot inspect, report the result as unverified instead of declaring protection absent.
- 04Rank findings. Show each failed expectation, the observed value, the policy value, and a source link. Keep approved exceptions, undefined policy and unreadable settings separate from failures. Do not classify an ambiguous not-found response as an unprotected repository.
- 05Return the report. Include repositories requested, fully assessed, with confirmed policy failures, and incomplete. Name the human changes needed and the exact checks to repeat afterward. A repository passes this review only when every required check has evidence.
// guardrails in the draft
Never change visibility, branch protection, rulesets, collaborators, or repository contents.
Configure read-only grants before running; a template does not attach or scope credentials.
Never expand the review to repositories outside the supplied scope.
Do not invent an approved baseline or silently accept a changed setting as the new policy.
Permission errors, pagination limits, and unsupported controls remain visible as incomplete coverage.
Passing this checklist does not establish compliance or absence of vulnerabilities.