[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M69BJW1WNZWXM2KB6C2ESYTS":3,"skill-same:01M69BJW1WNZWXM2KB6C2ESYTS":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":38,"commitSha":39,"skillDirectory":40,"forksCount":41,"repositoryHtmlUrl":42,"repositoryHomepageUrl":43,"ownerHtmlUrl":44,"ownerBlogUrl":45,"ownerDescription":46,"updatedAt":47,"install":48,"resources":61},"01M69BJW1WNZWXM2KB6C2ESYTS","ghqr-report",null,"Generate an executive assessment report from GitHub Quick Review (ghqr) scan data. Produces an executive summary, a dedicated section per validated subject with all findings, and a prioritized 30\u002F60\u002F90-day remediation plan. Use when the user asks for a report, executive summary, best practices posture overview, or a remediation roadmap from ghqr scan results.","microsoft\u002Fghqr","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M69BJK9MTS2DEZ9YVEH9VX7X",530,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fghqr\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fghqr-report\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32],"ghqr","report","ghqr report","assessment","github","generate","best practices","executive summary","review","2026-11-10 10:12:30",false,"---\nname: ghqr-report\ndescription: Generate an executive assessment report from GitHub Quick Review (ghqr) scan data. Produces an executive summary, a dedicated section per validated subject with all findings, and a prioritized 30\u002F60\u002F90-day remediation plan. Use when the user asks for a report, executive summary, best practices posture overview, or a remediation roadmap from ghqr scan results.\n---\n\n# GitHub Quick Review — Executive Report Skill\n\nExpert guidance for transforming ghqr scan JSON output into a structured executive report with findings by category and a prioritized 30\u002F60\u002F90-day remediation plan.\n\n## Overview\n\nThis skill enables agents to:\n- Trigger a ghqr scan (or consume an existing scan result) for an enterprise, organization, or repository\n- Produce a polished executive summary with overall best practices posture and key KPIs\n- Generate one dedicated section per validated category with its issues and recommendations\n- Build a prioritized remediation roadmap split into 30, 60, and 90-day milestones\n\n## When to Use This Skill\n\nTrigger this skill when the user asks for:\n- \"Generate a report\", \"executive report\", \"best practices report\", or \"posture report\"\n- \"Remediation plan\", \"action plan\", \"30\u002F60\u002F90 plan\"\n- \"What are the findings from the ghqr scan?\"\n- \"Show me the issues and how to fix them\"\n\n## Data Sources\n\nThe ghqr JSON output contains the following top-level structure:\n\n```json\n{\n  \"generated_at\": \"\u003CRFC3339 timestamp>\",\n  \"summary\": { \"total_scanned\": N, \"non_compliant\": N, \"by_severity\": {} },\n  \"enterprises\": {\n    \"\u003Cslug>\": {\n      \"ghas_settings\": {\n        \"advanced_security\": \"enabled|disabled|not_set\",\n        \"secret_scanning\": \"enabled|disabled|not_set\",\n        \"secret_scanning_push_protection\": \"enabled|disabled|not_set\",\n        \"dependabot_alerts\": \"enabled|disabled|not_set\",\n        \"dependabot_security_updates\": \"enabled|disabled|not_set\",\n        \"dependency_graph\": \"enabled|disabled|not_set\",\n        \"secret_scanning_non_provider_patterns\": \"enabled|disabled|not_set\"\n      },\n      \"evaluation\": { \"recommendations\": [] }\n    }\n  },\n  \"organizations\": {\n    \"\u003Cname>\": {\n      \"settings\": {\n        \"security\": {\n          \"advanced_security_enabled_for_new_repos\": true,\n          \"secret_scanning_enabled_for_new_repos\": true,\n          \"secret_scanning_push_protection_enabled_for_new_repos\": true,\n          \"dependabot_alerts_enabled_for_new_repos\": true,\n          \"dependabot_security_updates_enabled_for_new_repos\": true,\n          \"dependency_graph_enabled_for_new_repos\": true,\n          \"code_security_configurations\": {\n            \"configurations_readable\": true,\n            \"configurations\": [ { \"id\": 17, \"name\": \"GitHub recommended\", \"target_type\": \"global\", \"secret_scanning\": \"enabled\", \"...\": \"...\" } ],\n            \"defaults_readable\": false,\n            \"defaults_unavailable_reason\": \"forbidden\",\n            \"default_configurations\": null\n          }\n        }\n      },\n      \"evaluation\": { \"recommendations\": [] },\n      \"org_security_defaults_evaluation\": { \"recommendations\": [] }\n    }\n  },\n  \"repositories\":  { \"\u003Cowner\u002Fname>\": { \"evaluation\": { \"recommendations\": [] } } }\n}\n```\n\nEach `evaluation` object contains:\n- `recommendations[]`: all findings (both hard issues and advisory items), each with `severity`, `category`, `issue`, `recommendation`, and an optional `learn_more` URL\n\n### Organization New-Repository Security Defaults\n\nGitHub has deprecated (and now ignores) the organization `*_enabled_for_new_repos` fields in favour of **code security configurations**. The `org-def-001`…`007` findings are reported in `org_security_defaults_evaluation` (separate from the organization `evaluation`) and are scored as follows:\n\n- **Defaults readable** (`defaults_readable: true`): the default code security configurations are authoritative and the legacy fields are ignored. Each rule must be `enabled` in the default for both public and private\u002Finternal new repositories (`all` covers both). `org-def-007` (private vulnerability reporting) only checks public new repositories. `org-def-006` requires both GitHub Code Security and GitHub Secret Protection. The finding text names the uncovered scope and why (no default, disabled or not set in a named configuration, conflicting values).\n- **Defaults not readable**: the legacy fields are used and the finding text says the default configurations could not be read and why.\n- **Malformed default data** (unknown scope, missing configuration): every `org-def-*` finding is raised with \"could not be interpreted\"; treat it as unverified rather than confirmed disabled.\n- **Section absent** (older scans): legacy behaviour, unchanged titles.\n\nUse `settings.security.code_security_configurations` to add context:\n\n- `default_configurations[]` lists the configuration applied to new repositories per scope (`default_for_new_repos`: `public`, `private_and_internal`, or `all`), with the full `configuration` (feature states such as `secret_scanning`, `dependabot_alerts`, `enforcement`).\n- `configurations[]` lists every configuration available to the organization.\n- `configurations_readable` \u002F `defaults_readable` are independent. When `false`, the matching `*_unavailable_reason` is `forbidden` (token user is not an org owner or security manager, or lacks `read:org`), `not_found` (endpoint unavailable or access masked), or `error`. Report this as \"not readable\", never as \"no default configured\".\n- A readable empty array (`[]`) means no configuration \u002F no default is set.\n- If `code_security_configurations` is absent, the scan predates this data; say it was not collected.\n\nQuote the scope and reason from the finding text so the reader can distinguish \"not covered for public repositories\" from \"not readable\" or \"disabled everywhere\".\n\n### Severity Levels\n| Severity | Meaning |\n|----------|---------|\n| `critical` | Immediate risk, must fix now |\n| `high`     | Serious gap, fix within 30 days |\n| `medium`   | Important improvement, fix within 60 days |\n| `low`      | Minor gap, fix within 90 days |\n| `info`     | Advisory only |\n\n### Categories Validated by ghqr\n| Category | Description |\n|----------|-------------|\n| `security` | Enterprise GHAS policy defaults; org-wide secret scanning, push protection, and GHAS defaults for new repos; org-level open code scanning and secret scanning alerts |\n| `branch_protection` | Branch rules, required reviews, status checks |\n| `access_control` | Collaborator permissions, deploy keys, admin access |\n| `copilot_security` | Public code suggestions, content exclusions |\n| `copilot_cost` | Seat utilization, inactive seats |\n| `copilot_features` | IDE chat, CLI, platform chat enablement |\n| `copilot_models` | Allowed\u002Fblocked model configuration |\n| `copilot_mcp` | MCP server policy |\n| `copilot_extensions` | Extension allowlist |\n| `actions` | Workflow permissions, allowed actions, SHA pinning |\n| `community` | SECURITY.md, CODEOWNERS, contributing guidelines |\n| `dependencies` | Enterprise\u002Forg Dependabot alert defaults for new repos; Dependabot security updates defaults; aggregate open Dependabot alerts by severity |\n| `permissions` | Default repo permissions, member privileges |\n| `deployment` | Environment protection rules |\n| `maintenance` | Stale branches, archived repos, empty repos |\n| `risk` | Repository criticality, public visibility |\n| `features` | Advanced Security, wiki, issue tracker |\n\n## Workflow\n\n### Phase 1 — Acquire Scan Data\n\nIf the user provides a scan result file path or JSON, use it directly. Otherwise:\n\n1. Use the `ghqr_scan` tool to run a new scan:\n   - Pass `enterprises`, `organizations`, or `repositories` based on the user's scope\n   - The tool returns a file URI pointing to the JSON output\n2. Read the JSON output file to load the scan data\n\n### Phase 2 — Build the Report\n\nProduce the full report in Markdown following the **Report Template** below. Populate every section with real data from the scan; never invent findings.\n\n### Phase 3 — Validate Completeness\n\nBefore delivering the report, verify:\n- [ ] Executive summary reflects actual issue counts\n- [ ] Every category with at least one finding has its own section\n- [ ] Every issue listed in the scan appears somewhere in the report\n- [ ] Each finding in the 30\u002F60\u002F90 plan maps directly to a scan issue or recommendation\n- [ ] No findings are duplicated across plan phases\n\n---\n\n## Report Template\n\n```markdown\n# GitHub Assessment Report — [Enterprise\u002FOrganization\u002FRepository Name]\n\n**Scope:** [Enterprise \u002F Organization \u002F Repository]\n**Generated:** [Date]\n**Scan Coverage:** [N enterprises \u002F N organizations \u002F N repositories]\n\n---\n\n## Executive Summary\n\n> One paragraph (4–6 sentences) for a non-technical audience. State the overall\n> security posture, the number of critical and high findings, the biggest\n> risk areas, and the top improvement opportunity.\n\n### Posture Scorecard\n\n| Entity | Type | Critical | High | Medium | Low | Info |\n|--------|------|----------|------|--------|-----|------|\n| [name] | org  | 0 | 2 | 3 | 1 | 4 |\n| [repo] | repo | 1 | 1 | 2 | 0 | 2 |\n\n### Overall Risk Distribution\n\n| Severity | Count | % of Total |\n|----------|-------|-----------|\n| 🔴 Critical | N | X% |\n| 🟠 High     | N | X% |\n| 🟡 Medium   | N | X% |\n| 🟢 Low      | N | X% |\n| ℹ️ Info     | N | X% |\n\n---\n\n## Findings by Subject\n\n\u003C!-- Repeat this block for every category that has at least one issue or recommendation -->\n\n### [Category Display Name]  \u003C!-- e.g. \"Security — Dependabot & Code Scanning\" -->\n\n**Risk Level:** [Critical \u002F High \u002F Medium \u002F Low]  \n**Affected Entities:** [list of org\u002Frepo names]\n\n#### Findings\n\n| Severity | Entity | Finding | Action | Learn More |\n|----------|--------|---------|--------|------------|\n| 🔴 Critical | org\u002Frepo | [issue text from scan] | [recommendation text] | [link from `learn_more`] |\n| 🟠 High     | org\u002Frepo | [issue text] | [recommendation text] | [link from `learn_more`] |\n\n#### Why This Matters\n\n[2–3 sentences explaining the business\u002Fsecurity risk of this category in plain language]\n\n---\n\n\u003C!-- Categories with zero findings are omitted -->\n\n---\n\n## Remediation Plan\n\n### 30-Day Sprint — Immediate Actions 🔴\n\n> Address all **critical** and **high** severity issues. These represent the\n> highest risk to your organization and should be resolved within the first month.\n\n| Priority | Entity | Action | Category | Effort | Owner |\n|----------|--------|--------|----------|--------|-------|\n| 1 | [entity] | [specific fix] | [category] | [S\u002FM\u002FL] | [team] |\n| 2 | [entity] | [specific fix] | [category] | [S\u002FM\u002FL] | [team] |\n\n**Expected outcome:** [Risk reduction summary]\n\n---\n\n### 60-Day Sprint — High-Priority Improvements 🟠\n\n> Address all **medium** severity issues and any high-effort critical\u002Fhigh fixes\n> that couldn't be completed in the 30-day sprint.\n\n| Priority | Entity | Action | Category | Effort | Owner |\n|----------|--------|--------|----------|--------|-------|\n| 1 | [entity] | [specific fix] | [category] | [S\u002FM\u002FL] | [team] |\n\n**Expected outcome:** [Risk reduction summary]\n\n---\n\n### 90-Day Sprint — Strategic Hardening 🟡\n\n> Address all **low** severity issues, implement process improvements, and\n> establish ongoing governance controls.\n\n| Priority | Entity | Action | Category | Effort | Owner |\n|----------|--------|--------|----------|--------|-------|\n| 1 | [entity] | [specific fix] | [category] | [S\u002FM\u002FL] | [team] |\n\n**Expected outcome:** [Risk reduction summary]\n\n---\n\n## Manual Checks Required\n\nThe following security areas **cannot be verified automatically** via the GitHub\nAPI and require manual review:\n\n| Area | What to Check | Where |\n|------|--------------|-------|\n| Audit log streaming | Connected to SIEM | Enterprise → Settings → Audit log |\n| Secret scanning alerts | Open critical alerts reviewed and resolved | Repo → Security → Secret scanning |\n| Secret scanning: custom patterns | Org\u002Fenterprise-level custom patterns defined | Org → Settings → Code security → Secret scanning |\n| Secret scanning: bypass requests | Bypass request reviewers configured for push protection | Org → Settings → Code security → Secret scanning |\n| Code scanning: default setup | Default setup enabled on all active repos (no workflow required) | Repo → Settings → Code security → Code scanning |\n| Code scanning: alert triage | Open high\u002Fcritical code scanning alerts reviewed | Repo → Security → Code scanning |\n| Code scanning: tool coverage | All relevant languages covered by a scanning tool | Repo → Security → Code scanning |\n| Dependency review | dependency-review-action present in PR workflows | Repo → `.github\u002Fworkflows\u002F` |\n| Actions: self-hosted runners | Present on public repos | Repo → Settings → Actions → Runners |\n| Branch protection: enforce admins | Enabled | Repo → Settings → Branches |\n| Environment protection rules | Reviewers configured | Repo → Settings → Environments |\n| SAML SSO enforcement & SCIM | SSO enforced; SCIM provisioning active | Org → Settings → Authentication Security |\n| IP Allow List | Configured and enabled | Org → Settings → Authentication Security |\n| Org webhooks | SSL verification enabled, shared secret set on all hooks | Org → Settings → Webhooks |\n| Org-level rulesets | At least one ruleset defined for repo governance | Org → Settings → Rules → Rulesets |\n\n---\n\n## Appendix — Full Issue List\n\n### [Entity Name]\n\n\u003Cdetails>\n\u003Csummary>Expand all findings\u003C\u002Fsummary>\n\n| Severity | Category | Finding | Action | Learn More |\n|----------|----------|---------|--------|------------|\n| [sev] | [cat] | [issue] | [recommendation] | [learn_more URL as hyperlink, or blank if empty] |\n\n\u003C\u002Fdetails>\n```\n\n---\n\n## Category Display Name Mapping\n\nWhen rendering category names in the report use these human-readable titles:\n\n| Raw category | Display name |\n|--------------|-------------|\n| `security` | Security — Vulnerability Management |\n| `branch_protection` | Branch Protection |\n| `access_control` | Access Control & Permissions |\n| `copilot_security` | GitHub Copilot — Security & Compliance |\n| `copilot_cost` | GitHub Copilot — Cost & Seat Utilization |\n| `copilot_features` | GitHub Copilot — Feature Enablement |\n| `copilot_models` | GitHub Copilot — Model Policy |\n| `copilot_mcp` | GitHub Copilot — MCP Configuration |\n| `copilot_extensions` | GitHub Copilot — Extensions |\n| `actions` | GitHub Actions — Workflow Security |\n| `community` | Community Health & Documentation |\n| `dependencies` | Dependency Management |\n| `permissions` | Member & Repository Permissions |\n| `deployment` | Deployment & Environment Controls |\n| `maintenance` | Repository Maintenance |\n| `risk` | Visibility & Risk Exposure |\n| `features` | Advanced Security Features |\n\n## Effort Sizing Guide\n\nWhen populating the **Effort** column in the plan tables:\n\n| Label | Definition |\n|-------|-----------|\n| S — Small | Single setting toggle or one-click configuration; \u003C 1 hour |\n| M — Medium | Requires creating a file, policy, or workflow; 1–4 hours |\n| L — Large | Requires team coordination, design decision, or phased rollout; 1+ days |\n\n## Output Requirements\n\nThe agent MUST:\n1. **Always use real scan data** — never fabricate issues\n2. **Include every category** that has at least one finding; skip categories with zero findings\n3. **Map every finding to exactly one plan phase** based on its severity:\n   - `critical` + `high` → 30-day sprint\n   - `medium` → 60-day sprint\n   - `low` + `info` → 90-day sprint\n4. **Estimate effort** using S\u002FM\u002FL sizing for each action item\n5. **List manual checks** that ghqr cannot automate (reference `references\u002FMANUAL_CHECKS.md` categories)\n","# GitHub Quick Review — Executive Report Skill\n\nExpert guidance for transforming ghqr scan JSON output into a structured executive report with findings by category and a prioritized 30\u002F60\u002F90-day remediation plan.\n\n## Overview\n\nThis skill enables agents to:\n- Trigger a ghqr scan (or consume an existing scan result) for an enterprise, organization, or repository\n- Produce a polished executive summary with overall best practices posture and key KPIs\n- Generate one dedicated section per validated category with its issues and recommendations\n- Build a prioritized remediation roadmap split into 30, 60, and 90-day milestones\n\n## When to Use This Skill\n\nTrigger this skill when the user asks for:\n- \"Generate a report\", \"executive report\", \"best practices report\", or \"posture report\"\n- \"Remediation plan\", \"action plan\", \"30\u002F60\u002F90 plan\"\n- \"What are the findings from the ghqr scan?\"\n- \"Show me the issues and how to fix them\"\n\n## Data Sources\n\nThe ghqr JSON output contains the following top-level structure:\n\n```json\n{\n  \"generated_at\": \"\u003CRFC3339 timestamp>\",\n  \"summary\": { \"total_scanned\": N, \"non_compliant\": N, \"by_severity\": {} },\n  \"enterprises\": {\n    \"\u003Cslug>\": {\n      \"ghas_settings\": {\n        \"advanced_security\": \"enabled|disabled|not_set\",\n        \"secret_scanning\": \"enabled|disabled|not_set\",\n        \"secret_scanning_push_protection\": \"enabled|disabled|not_set\",\n        \"dependabot_alerts\": \"enabled|disabled|not_set\",\n        \"dependabot_security_updates\": \"enabled|disabled|not_set\",\n        \"dependency_graph\": \"enabled|disabled|not_set\",\n        \"secret_scanning_non_provider_patterns\": \"enabled|disabled|not_set\"\n      },\n      \"evaluation\": { \"recommendations\": [] }\n    }\n  },\n  \"organizations\": {\n    \"\u003Cname>\": {\n      \"settings\": {\n        \"security\": {\n          \"advanced_security_enabled_for_new_repos\": true,\n          \"secret_scanning_enabled_for_new_repos\": true,\n          \"secret_scanning_push_protection_enabled_for_new_repos\": true,\n          \"dependabot_alerts_enabled_for_new_repos\": true,\n          \"dependabot_security_updates_enabled_for_new_repos\": true,\n          \"dependency_graph_enabled_for_new_repos\": true,\n          \"code_security_configurations\": {\n            \"configurations_readable\": true,\n            \"configurations\": [ { \"id\": 17, \"name\": \"GitHub recommended\", \"target_type\": \"global\", \"secret_scanning\": \"enabled\", \"...\": \"...\" } ],\n            \"defaults_readable\": false,\n            \"defaults_unavailable_reason\": \"forbidden\",\n            \"default_configurations\": null\n          }\n        }\n      },\n      \"evaluation\": { \"recommendations\": [] },\n      \"org_security_defaults_evaluation\": { \"recommendations\": [] }\n    }\n  },\n  \"repositories\":  { \"\u003Cowner\u002Fname>\": { \"evaluation\": { \"recommendations\": [] } } }\n}\n```\n\nEach `evaluation` object contains:\n- `recommendations[]`: all findings (both hard issues and advisory items), each with `severity`, `category`, `issue`, `recommendation`, and an optional `learn_more` URL\n\n### Organization New-Repository Security Defaults\n\nGitHub has deprecated (and now ignores) the organization `*_enabled_for_new_repos` fields in favour of **code security configurations**. The `org-def-001`…`007` findings are reported in `org_security_defaults_evaluation` (separate from the organization `evaluation`) and are scored as follows:\n\n- **Defaults readable** (`defaults_readable: true`): the default code security configurations are authoritative and the legacy fields are ignored. Each rule must be `enabled` in the default for both public and private\u002Finternal new repositories (`all` covers both). `org-def-007` (private vulnerability reporting) only checks public new repositories. `org-def-006` requires both GitHub Code Security and GitHub Secret Protection. The finding text names the uncovered scope and why (no default, disabled or not set in a named configuration, conflicting values).\n- **Defaults not readable**: the legacy fields are used and the finding text says the default configurations could not be read and why.\n- **Malformed default data** (unknown scope, missing configuration): every `org-def-*` finding is raised with \"could not be interpreted\"; treat it as unverified rather than confirmed disabled.\n- **Section absent** (older scans): legacy behaviour, unchanged titles.\n\nUse `settings.security.code_security_configurations` to add context:\n\n- `default_configurations[]` lists the configuration applied to new repositories per scope (`default_for_new_repos`: `public`, `private_and_internal`, or `all`), with the full `configuration` (feature states such as `secret_scanning`, `dependabot_alerts`, `enforcement`).\n- `configurations[]` lists every configuration available to the organization.\n- `configurations_readable` \u002F `defaults_readable` are independent. When `false`, the matching `*_unavailable_reason` is `forbidden` (token user is not an org owner or security manager, or lacks `read:org`), `not_found` (endpoint unavailable or access masked), or `error`. Report this as \"not readable\", never as \"no default configured\".\n- A readable empty array (`[]`) means no configuration \u002F no default is set.\n- If `code_security_configurations` is absent, the scan predates this data; say it was not collected.\n\nQuote the scope and reason from the finding text so the reader can distinguish \"not covered for public repositories\" from \"not readable\" or \"disabled everywhere\".\n\n### Severity Levels\n| Severity | Meaning |\n|----------|---------|\n| `critical` | Immediate risk, must fix now |\n| `high`     | Serious gap, fix within 30 days |\n| `medium`   | Important improvement, fix within 60 days |\n| `low`      | Minor gap, fix within 90 days |\n| `info`     | Advisory only |\n\n### Categories Validated by ghqr\n| Category | Description |\n|----------|-------------|\n| `security` | Enterprise GHAS policy defaults; org-wide secret scanning, push protection, and GHAS defaults for new repos; org-level open code scanning and secret scanning alerts |\n| `branch_protection` | Branch rules, required reviews, status checks |\n| `access_control` | Collaborator permissions, deploy keys, admin access |\n| `copilot_security` | Public code suggestions, content exclusions |\n| `copilot_cost` | Seat utilization, inactive seats |\n| `copilot_features` | IDE chat, CLI, platform chat enablement |\n| `copilot_models` | Allowed\u002Fblocked model configuration |\n| `copilot_mcp` | MCP server policy |\n| `copilot_extensions` | Extension allowlist |\n| `actions` | Workflow permissions, allowed actions, SHA pinning |\n| `community` | SECURITY.md, CODEOWNERS, contributing guidelines |\n| `dependencies` | Enterprise\u002Forg Dependabot alert defaults for new repos; Dependabot security updates defaults; aggregate open Dependabot alerts by severity |\n| `permissions` | Default repo permissions, member privileges |\n| `deployment` | Environment protection rules |\n| `maintenance` | Stale branches, archived repos, empty repos |\n| `risk` | Repository criticality, public visibility |\n| `features` | Advanced Security, wiki, issue tracker |\n\n## Workflow\n\n### Phase 1 — Acquire Scan Data\n\nIf the user provides a scan result file path or JSON, use it directly. Otherwise:\n\n1. Use the `ghqr_scan` tool to run a new scan:\n   - Pass `enterprises`, `organizations`, or `repositories` based on the user's scope\n   - The tool returns a file URI pointing to the JSON output\n2. Read the JSON output file to load the scan data\n\n### Phase 2 — Build the Report\n\nProduce the full report in Markdown following the **Report Template** below. Populate every section with real data from the scan; never invent findings.\n\n### Phase 3 — Validate Completeness\n\nBefore delivering the report, verify:\n- [ ] Executive summary reflects actual issue counts\n- [ ] Every category with at least one finding has its own section\n- [ ] Every issue listed in the scan appears somewhere in the report\n- [ ] Each finding in the 30\u002F60\u002F90 plan maps directly to a scan issue or recommendation\n- [ ] No findings are duplicated across plan phases\n\n---\n\n## Report Template\n\n```markdown\n# GitHub Assessment Report — [Enterprise\u002FOrganization\u002FRepository Name]\n\n**Scope:** [Enterprise \u002F Organization \u002F Repository]\n**Generated:** [Date]\n**Scan Coverage:** [N enterprises \u002F N organizations \u002F N repositories]\n\n---\n\n## Executive Summary\n\n> One paragraph (4–6 sentences) for a non-technical audience. State the overall\n> security posture, the number of critical and high findings, the biggest\n> risk areas, and the top improvement opportunity.\n\n### Posture Scorecard\n\n| Entity | Type | Critical | High | Medium | Low | Info |\n|--------|------|----------|------|--------|-----|------|\n| [name] | org  | 0 | 2 | 3 | 1 | 4 |\n| [repo] | repo | 1 | 1 | 2 | 0 | 2 |\n\n### Overall Risk Distribution\n\n| Severity | Count | % of Total |\n|----------|-------|-----------|\n| 🔴 Critical | N | X% |\n| 🟠 High     | N | X% |\n| 🟡 Medium   | N | X% |\n| 🟢 Low      | N | X% |\n| ℹ️ Info     | N | X% |\n\n---\n\n## Findings by Subject\n\n\u003C!-- Repeat this block for every category that has at least one issue or recommendation -->\n\n### [Category Display Name]  \u003C!-- e.g. \"Security — Dependabot & Code Scanning\" -->\n\n**Risk Level:** [Critical \u002F High \u002F Medium \u002F Low]  \n**Affected Entities:** [list of org\u002Frepo names]\n\n#### Findings\n\n| Severity | Entity | Finding | Action | Learn More |\n|----------|--------|---------|--------|------------|\n| 🔴 Critical | org\u002Frepo | [issue text from scan] | [recommendation text] | [link from `learn_more`] |\n| 🟠 High     | org\u002Frepo | [issue text] | [recommendation text] | [link from `learn_more`] |\n\n#### Why This Matters\n\n[2–3 sentences explaining the business\u002Fsecurity risk of this category in plain language]\n\n---\n\n\u003C!-- Categories with zero findings are omitted -->\n\n---\n\n## Remediation Plan\n\n### 30-Day Sprint — Immediate Actions 🔴\n\n> Address all **critical** and **high** severity issues. These represent the\n> highest risk to your organization and should be resolved within the first month.\n\n| Priority | Entity | Action | Category | Effort | Owner |\n|----------|--------|--------|----------|--------|-------|\n| 1 | [entity] | [specific fix] | [category] | [S\u002FM\u002FL] | [team] |\n| 2 | [entity] | [specific fix] | [category] | [S\u002FM\u002FL] | [team] |\n\n**Expected outcome:** [Risk reduction summary]\n\n---\n\n### 60-Day Sprint — High-Priority Improvements 🟠\n\n> Address all **medium** severity issues and any high-effort critical\u002Fhigh fixes\n> that couldn't be completed in the 30-day sprint.\n\n| Priority | Entity | Action | Category | Effort | Owner |\n|----------|--------|--------|----------|--------|-------|\n| 1 | [entity] | [specific fix] | [category] | [S\u002FM\u002FL] | [team] |\n\n**Expected outcome:** [Risk reduction summary]\n\n---\n\n### 90-Day Sprint — Strategic Hardening 🟡\n\n> Address all **low** severity issues, implement process improvements, and\n> establish ongoing governance controls.\n\n| Priority | Entity | Action | Category | Effort | Owner |\n|----------|--------|--------|----------|--------|-------|\n| 1 | [entity] | [specific fix] | [category] | [S\u002FM\u002FL] | [team] |\n\n**Expected outcome:** [Risk reduction summary]\n\n---\n\n## Manual Checks Required\n\nThe following security areas **cannot be verified automatically** via the GitHub\nAPI and require manual review:\n\n| Area | What to Check | Where |\n|------|--------------|-------|\n| Audit log streaming | Connected to SIEM | Enterprise → Settings → Audit log |\n| Secret scanning alerts | Open critical alerts reviewed and resolved | Repo → Security → Secret scanning |\n| Secret scanning: custom patterns | Org\u002Fenterprise-level custom patterns defined | Org → Settings → Code security → Secret scanning |\n| Secret scanning: bypass requests | Bypass request reviewers configured for push protection | Org → Settings → Code security → Secret scanning |\n| Code scanning: default setup | Default setup enabled on all active repos (no workflow required) | Repo → Settings → Code security → Code scanning |\n| Code scanning: alert triage | Open high\u002Fcritical code scanning alerts reviewed | Repo → Security → Code scanning |\n| Code scanning: tool coverage | All relevant languages covered by a scanning tool | Repo → Security → Code scanning |\n| Dependency review | dependency-review-action present in PR workflows | Repo → `.github\u002Fworkflows\u002F` |\n| Actions: self-hosted runners | Present on public repos | Repo → Settings → Actions → Runners |\n| Branch protection: enforce admins | Enabled | Repo → Settings → Branches |\n| Environment protection rules | Reviewers configured | Repo → Settings → Environments |\n| SAML SSO enforcement & SCIM | SSO enforced; SCIM provisioning active | Org → Settings → Authentication Security |\n| IP Allow List | Configured and enabled | Org → Settings → Authentication Security |\n| Org webhooks | SSL verification enabled, shared secret set on all hooks | Org → Settings → Webhooks |\n| Org-level rulesets | At least one ruleset defined for repo governance | Org → Settings → Rules → Rulesets |\n\n---\n\n## Appendix — Full Issue List\n\n### [Entity Name]\n\n\u003Cdetails>\n\u003Csummary>Expand all findings\u003C\u002Fsummary>\n\n| Severity | Category | Finding | Action | Learn More |\n|----------|----------|---------|--------|------------|\n| [sev] | [cat] | [issue] | [recommendation] | [learn_more URL as hyperlink, or blank if empty] |\n\n\u003C\u002Fdetails>\n```\n\n---\n\n## Category Display Name Mapping\n\nWhen rendering category names in the report use these human-readable titles:\n\n| Raw category | Display name |\n|--------------|-------------|\n| `security` | Security — Vulnerability Management |\n| `branch_protection` | Branch Protection |\n| `access_control` | Access Control & Permissions |\n| `copilot_security` | GitHub Copilot — Security & Compliance |\n| `copilot_cost` | GitHub Copilot — Cost & Seat Utilization |\n| `copilot_features` | GitHub Copilot — Feature Enablement |\n| `copilot_models` | GitHub Copilot — Model Policy |\n| `copilot_mcp` | GitHub Copilot — MCP Configuration |\n| `copilot_extensions` | GitHub Copilot — Extensions |\n| `actions` | GitHub Actions — Workflow Security |\n| `community` | Community Health & Documentation |\n| `dependencies` | Dependency Management |\n| `permissions` | Member & Repository Permissions |\n| `deployment` | Deployment & Environment Controls |\n| `maintenance` | Repository Maintenance |\n| `risk` | Visibility & Risk Exposure |\n| `features` | Advanced Security Features |\n\n## Effort Sizing Guide\n\nWhen populating the **Effort** column in the plan tables:\n\n| Label | Definition |\n|-------|-----------|\n| S — Small | Single setting toggle or one-click configuration; \u003C 1 hour |\n| M — Medium | Requires creating a file, policy, or workflow; 1–4 hours |\n| L — Large | Requires team coordination, design decision, or phased rollout; 1+ days |\n\n## Output Requirements\n\nThe agent MUST:\n1. **Always use real scan data** — never fabricate issues\n2. **Include every category** that has at least one finding; skip categories with zero findings\n3. **Map every finding to exactly one plan phase** based on its severity:\n   - `critical` + `high` → 30-day sprint\n   - `medium` → 60-day sprint\n   - `low` + `info` → 90-day sprint\n4. **Estimate effort** using S\u002FM\u002FL sizing for each action item\n5. **List manual checks** that ghqr cannot automate (reference `references\u002FMANUAL_CHECKS.md` categories)\n",{"name":5,"description":7},"main","fb3e6aa566299b8ea43ff261a302c10057a1cd6f",".github\u002Fskills\u002Fghqr-report",36,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fghqr","https:\u002F\u002Fmicrosoft.github.io\u002Fghqr\u002F","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-11 16:54:39",{"source":8,"skillName":5,"commands":49,"prompt":59,"zipAvailable":60},[50,53,56],{"tool":51,"command":52},"npx","npx skills add microsoft\u002Fghqr --skill ghqr-report",{"tool":54,"command":55},"bunx","bunx skills add microsoft\u002Fghqr --skill ghqr-report",{"tool":57,"command":58},"pnpm","pnpm dlx skills add microsoft\u002Fghqr --skill ghqr-report","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fghqr\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fghqr-report\u002FSKILL.md",true,[62],{"path":63,"resourceType":64,"resourceTypeDesc":65,"sizeBytes":66,"sourceHtmlUrl":67},"references\u002FMANUAL_CHECKS.md","REFERENCE","参考文档",7826,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fghqr\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fghqr-report\u002Freferences\u002FMANUAL_CHECKS.md",[69,85,106],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":78,"publishedAt":33},"01M69BJZ29V4C6KDDK555QFHRZ","tui-developer","Generate Go Bubble Tea TUI applications with chat-like interfaces. Use when the user asks to create terminal UIs, chat interfaces, interactive CLI, REPLs, or log viewers. Follow the specified architecture and implementation requirements for consistent results.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fghqr\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Ftui-developer\u002FSKILL.md",[75],{"categoryNo":76,"categoryName":77,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师",[79,80,81,82,83,84,29],"tui developer","cli","terminal","go","architecture","create",{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":96,"publishedAt":33},"01M69BJRYGJPA08NHF6YEAXG94","copilot-sdk","Build agentic applications with GitHub Copilot SDK. Use when embedding AI agents in apps, creating custom tools, implementing streaming responses, managing sessions, connecting to MCP servers, or creating custom agents. Triggers on Copilot SDK, GitHub SDK, agentic app, embed Copilot, programmable agent, MCP server, custom agent.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fghqr\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fcopilot-sdk\u002FSKILL.md",[91],{"categoryNo":92,"categoryName":93,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[97,98,99,100,101,28,102,103,104,105],"copilot sdk","copilot","sdk","agentic","ai agents","mcp server","sessions","github copilot","MCP",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":113,"publishedAt":33},"01M69BJNJQXB7WS6Q2WPYP8KVF","code-simplifier","Analyzes recently modified code and creates pull requests with simplifications that improve clarity, consistency, and maintainability while preserving functionality","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fghqr\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fcode-simplifier\u002FSKILL.md",[112],{"categoryNo":76,"categoryName":77,"taxonomyType":21,"taxonomyTypeDesc":22},[114,115,116],"code","code simplifier","pull requests"]