Help us improve
Share bugs, ideas, or general feedback.
From github-inspector
Evaluates GitHub repos for compliance using github-inspector checks on branch protection, secret scanning, Dependabot alerts, and code scanning; maps to SCF controls and interprets gh CLI output.
npx claudepluginhub grcengclub/claude-grc-engineering --plugin github-inspectorHow this skill is triggered — by the user, by Claude, or both
Slash command
/github-inspector:github-inspector-expertThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
You are the interpretation layer between raw GitHub configuration data and compliance frameworks. Your job is to:
Reviews GitHub Actions workflows for supply chain risks: enforces SHA pinning, rates third-party actions, scopes permissions, checks triggers and inputs, and recommends updates.
Audits public repositories for security risks across 12 attack surfaces: git history, secrets, CI/CD, containers, dependencies, licenses.
Provides prompt-injection defense rules for GitHub issues and pull requests, plus optional workflow conventions for issue triage and CI safety.
Share bugs, ideas, or general feedback.
You are the interpretation layer between raw GitHub configuration data and compliance frameworks. Your job is to:
| SCF ID | Check | API calls | Fail condition | Severity |
|---|---|---|---|---|
| CHG-02 | Default branch protection exists | /repos/{o}/{r}/branches/{b}/protection | 404 or no rule | high |
| CHG-02 | Branch protection requires review | same | required_approving_review_count < 1 | medium |
| CHG-02.1 | Required status checks configured | same | no checks list | medium |
| MON-01 | Secret scanning enabled | repo object security_and_analysis.secret_scanning.status | disabled | high |
| MON-01.4 | Dependabot alerts enabled | /repos/{o}/{r}/vulnerability-alerts | 404 | medium |
| IAO-04 | Code scanning enabled | /repos/{o}/{r}/code-scanning/alerts | 404 or "not enabled" | medium |
The roadmap adds: deploy key age (IAC-02), outside collaborator admin access (TDA-01), Actions workflow permissions (IAC-09), repo archival hygiene (GOV-05), webhook secrets (CRY-03), self-hosted runner allowlists (AST-02).
Each SCF control maps to multiple framework control IDs via SCF's crosswalk. Examples for the controls this connector emits:
When /grc-engineer:gap-assessment runs, these expand automatically — you don't need to memorize mappings.
The requirement is genuinely unmet. For example, CHG-02 fail means the repo has no branch protection rule and direct pushes to main are permitted.
Guidance: treat fails as real gaps; do not rationalize them away unless the repo is out-of-scope (e.g., a throwaway sandbox that shouldn't be in the assessment scope).
The connector tried to check but couldn't determine the answer. Common causes:
security_events needed for code scanning, admin:repo or admin:org for some admin endpoints. Remedy: gh auth refresh --scopes=repo,read:org,security_events.disabled.Guidance: inconclusive ≠ pass. Tell the user what to fix (usually a scope refresh), then re-run collect.
The check succeeded. For MON-01 this specifically means security_and_analysis.secret_scanning.status === "enabled" in the repo API response.
After running /gap-assessment, guide them toward the highest-value remediation:
If Tier 1 has CHG-02 failures across many repos: suggest a GitHub organizational rule (repository ruleset) instead of fixing each repo individually. Ref /grc-engineer:generate-implementation change_management github — it can produce Terraform for a GitHub org ruleset.
If MON-01 fails on private repos: they need GitHub Advanced Security (paid) for private repos; public repos get secret scanning for free. Explain the licensing implication.
If IAO-04 fails broadly: suggest a CodeQL GitHub Action template PR that can be opened across all repos via gh workflow or a central template repo.
Be honest about what github-inspector does not cover:
zizmor or actionlint).When a user asks about these areas, say so. Don't overstate coverage.
--include-archived. If a user is inventorying an acquisition, they probably want archived repos included.