Github Public Readiness

GitHub Public Readiness

Audit a repository before making it public. Treat the assessment as advisory: do not change repository visibility, delete history, rotate credentials, or publish anything unless explicitly asked.

Workflow

1. Establish scope: inspect the current branch, repository history, tracked files, ignored files, documentation, dependency manifests, CI configuration, and release artifacts if present. State any unavailable areas.
2. Look for disclosure risks. Use targeted searches for credentials, private keys, tokens, connection strings, personal contact details, customer or employer information, internal URLs, production data, credentials in Git history, and large/generated artifacts. Treat matches as leads; distinguish real secrets from placeholders and public test values.
3. Check usability and hygiene: confirm the purpose is legible; assess README quality, license, contribution/security guidance where appropriate, setup instructions, dependency health, tests, build/run status, and stale or broken references.
4. Assess portfolio value separately from safety. Consider clarity of the problem, implementation quality, originality, evidence of current functionality, and whether the repo demonstrates skills the owner wants to highlight.
5. Produce a concise report using the format in [references/report-template.md](references/report-template.md). Give concrete file paths, evidence, and prioritized actions. Do not overstate findings when evidence is incomplete.

Classification

Choose one overall public-readiness classification:

• Publish Now — no material disclosure risks; documentation and basic hygiene are adequate.
• Light Cleanup — safe after a short, clearly scoped set of fixes.
• Significant Cleanup — meaningful security, privacy, usability, or maintenance work is needed first.
• Keep Private — public release would expose sensitive context, create substantial risk, or is not aligned with the repository's purpose.
• Archive — retaining the repository publicly offers little value and its condition does not justify cleanup.

Do not infer that a portfolio recommendation is a visibility recommendation. A repository may be safe to publish without being suitable to pin or showcase.

Evidence standards

• Prefer file paths, commit hashes, command output, and reproducible checks over general impressions.
• Inspect Git history for formerly committed secrets when the history is available; removing a secret from the working tree is not enough.
• If a real credential may be exposed, recommend revocation/rotation before any history rewrite. Do not display the full value in the report.
• Flag uncertainty clearly, especially when secrets scanning, build verification, or network-dependent checks could not be completed.
• Use [references/audit-rubric.md](references/audit-rubric.md) for detailed checklists and decision guidance.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: erik-fryscok
• Source: erik-fryscok/skills
• License: MIT

Install and usage instructions live in the source repository linked above.