Security-first audit of the per-repo GitHub setting "Allow GitHub Actions to create and approve pull requests" (canapprovepullrequestreviews) across an account. Flags repos where Actions CAN approve PRs — a required-review bypass risk (OpenSSF) — unless you intentionally allow them. Read-only: it never changes settings; it prints the exact gh command for you to run. Use when you ask: "audit Actions PR permissions", "can GitHub Actions approve PRs?", "PR approval setting check", "Actions PR 権限監査", "review-bypass チェック". DO NOT USE FOR: creating PRs, changing branch protection, or writing code.
EnglishOpenSSF-aligned security posture audit across all repos in a GitHub account: default workflow token permissions, allowed-actions policy, branch protection, secret scanning + push protection, and Dependabot alerts. Reports WARN (fixable gaps) vs INFO (opinionated hardening). Read-only by default; the only optional mutation is enabling Dependabot alerts. Use when you ask: "repo security audit", "OpenSSF audit", "are Dependabot alerts on?", "GitHub hardening check", "repo セキュリティ監査", "Actions セキュリティ横断". DO NOT USE FOR: writing code, changing branch protection automatically, or the PR-approval toggle (use gh-pr-perm-audit for that).
EnglishAddress open GitHub PR review comments automatically. For each unresolved comment, classifies as MUST-FIX (edit code), ACK (reply only), or DISCUSS (ask back). Edits the relevant files, commits, and drafts a response comment for each item. Use when you receive PR review feedback and want to address all comments in one pass. Triggers on: "PRのコメントに対応", "review comments", "address PR feedback", "レビュー対応", "pr-respond", "コメント修正". DO NOT USE FOR: creating new PRs, writing code from scratch, or Issue responses.
EnglishGenerate a comprehensive onboarding guide for any codebase. Produces a REPOTOUR.md with a 30-second summary, annotated directory tree, Mermaid architecture diagram, key files list, and "where to look for X" quick-reference. Use when you''re new to a codebase, onboarding a team member, or need to document the overall structure. Also useful after a major refactor to update understanding. Triggers on: "このリポジトリを説明して", "コードベースを理解したい", "repo tour", "architecture overview", "repo-tour", "onboarding", "どこから読めばいい". DO NOT USE FOR: editing code, fixing bugs, or creating documentation beyond structure.
English
AGENT SKILLS ATLASIncludes Gh PR Perm Audit, Gh Repo Security Audit, PR Respond, and other workflows.
Claude Code
Codex
Cursor
GitHub Copilot
Gemini CLISupported by the Atlas install prompt. Skill-specific requirements vary.
Pack stats
What’s included
Gh PR Perm Audit
Security-first audit of the per-repo GitHub setting "Allow GitHub Actions to create and approve pull requests" (canapprovepullrequestreviews) across an account. Flags repos where Actions CAN approve PRs — a required-review bypass risk (OpenSSF) — unless you intentionally allow them. Read-only: it never changes settings; it prints the exact gh command for you to run. Use when you ask: "audit Actions PR permissions", "can GitHub Actions approve PRs?", "PR approval setting check", "Actions PR 権限監査", "review-bypass チェック". DO NOT USE FOR: creating PRs, changing branch protection, or writing code.
Gh Repo Security Audit
OpenSSF-aligned security posture audit across all repos in a GitHub account: default workflow token permissions, allowed-actions policy, branch protection, secret scanning + push protection, and Dependabot alerts. Reports WARN (fixable gaps) vs INFO (opinionated hardening). Read-only by default; the only optional mutation is enabling Dependabot alerts. Use when you ask: "repo security audit", "OpenSSF audit", "are Dependabot alerts on?", "GitHub hardening check", "repo セキュリティ監査", "Actions セキュリティ横断". DO NOT USE FOR: writing code, changing branch protection automatically, or the PR-approval toggle (use gh-pr-perm-audit for that).
PR Respond
Address open GitHub PR review comments automatically. For each unresolved comment, classifies as MUST-FIX (edit code), ACK (reply only), or DISCUSS (ask back). Edits the relevant files, commits, and drafts a response comment for each item. Use when you receive PR review feedback and want to address all comments in one pass. Triggers on: "PRのコメントに対応", "review comments", "address PR feedback", "レビュー対応", "pr-respond", "コメント修正". DO NOT USE FOR: creating new PRs, writing code from scratch, or Issue responses.
Repo Tour
Generate a comprehensive onboarding guide for any codebase. Produces a REPOTOUR.md with a 30-second summary, annotated directory tree, Mermaid architecture diagram, key files list, and "where to look for X" quick-reference. Use when you''re new to a codebase, onboarding a team member, or need to document the overall structure. Also useful after a major refactor to update understanding. Triggers on: "このリポジトリを説明して", "コードベースを理解したい", "repo tour", "architecture overview", "repo-tour", "onboarding", "どこから読めばいい". DO NOT USE FOR: editing code, fixing bugs, or creating documentation beyond structure.
Quick start
- Choose your skills. Select individual skills above, or choose the entire pack.
- Copy the install prompt. Use Copy install prompt above the list.
- Send it to your agent. Paste into your coding agent’s chat. Your agent reviews the source and guides the setup.
Try it with your agent
After installation, start with a request like:
Use the Gh PR Perm Audit skill to help with my task.
Ask me for the context you need before getting started.Requirements & license
- A coding agent that can access your project files and install skills.
- Your agent checks each skill’s instructions, dependencies, and permissions during setup.
- Reported license for the skills shown: MIT. The author’s terms apply.