Repository Trust Analyzer

Contents

• •Quick start
• •Analysis workflow
• •Understanding results
• •Example output
• •Validation loop
• •Scoring methodology → See SCORING.md

Quick Start

/repo-check <target>

Where <target> is one of:

• •owner/repo — shorthand (e.g. facebook/react)
• •https://github.com/owner/repo — full URL
• •https://github.com/owner/repo/blob/branch/path/SKILL.md — SKILL.md URL

Analysis Workflow

Copy and track progress:

Repository Trust Analysis:
- [ ] Step 1: Parse input to extract owner/repo
- [ ] Step 2: Verify gh CLI authentication
- [ ] Step 3: Build and run the analyzer
- [ ] Step 4: Review trust signal and category scores
- [ ] Step 5: Review any warnings
- [ ] Step 6: Make adoption decision

Understanding Results

Trust Signal Levels

Categories Analyzed

Example Output

# Repository Trust Report: facebook/react

**URL:** https://github.com/facebook/react

## Overall Trust Signal: HIGH

## Popularity — HIGH

| Metric | Value |
|--------|-------|
| Stars | 230000 |
| Forks | 47000 |
| Watchers | 6500 |

## Activity — HIGH

| Metric | Value |
|--------|-------|
| Last commit | 2026-02-15T10:30:00Z (1 days ago) |
| Commits (90d) | 350 |
| Open issues | 900 |
| Contributors | 1800 |

## Security — MODERATE

| Metric | Value |
|--------|-------|
| License | MIT License (MIT) |
| OpenSSF Scorecard | Not available |

## Maturity — HIGH

| Metric | Value |
|--------|-------|
| Releases | 100 |
| README | true |
| Contributing guide | true |
| CI/CD | true |

Validation Loop

1. •Run analysis: /repo-check <target>
2. •Review the overall trust signal
3. •If MODERATE or LOW:
   • •Check the warnings section for specific concerns
   • •Review the lowest-scoring categories
   • •Investigate flagged areas manually
4. •For skill adoption:
   • •HIGH → proceed with standard code review
   • •MODERATE → deeper review of flagged areas, check issue tracker
   • •LOW → consider alternatives, require team sign-off
5. •Re-run periodically to track changes

Instructions

When the user invokes this skill:

1. •

   Parse the input to extract owner/repo from the provided target (shorthand, URL, or SKILL.md URL).

2. •

   Check that gh CLI is authenticated:

   bash

   gh auth status
   

3. •

   Build and run the analyzer binary:

   bash

   cd repo-check && go build -o repo-check . && ./repo-check <target>
   

   For JSON output:

   bash

   cd repo-check && go build -o repo-check . && ./repo-check --json <target>
   

4. •

   Present the structured report to the user, highlighting:

   • •The overall trust signal (HIGH/MODERATE/LOW)
   • •Any warnings that need attention
   • •Category-level scores for deeper analysis
5. •

   If the Go binary is unavailable (build fails, Go not installed), fall back to manual gh api calls:

   bash

   # Repo metadata
   gh api repos/{owner}/{repo}
   
   # Commit activity
   gh api repos/{owner}/{repo}/stats/participation
   
   # Community profile
   gh api repos/{owner}/{repo}/community/profile
   
   # Releases
   gh api repos/{owner}/{repo}/releases?per_page=100
   

   Then manually assess trust signals based on the raw data and the scoring methodology in SCORING.md.

6. •

   Provide a recommendation based on the trust signal and the user's context (adopting a dependency vs. evaluating a skill vs. general assessment).