committer-2fa-audit
Audit source-control organization settings for strong 2FA/MFA requirements across all committers
- License 许可
- MIT
- 所属仓库
- jmagly/aiwg
- 最近更新
- 2026-11-11
- Stars
- ★ 229
- Forks
- 36
01 前言 Front Matter
- name
- committer-2fa-audit
- errors
- [ { "token-missing": "org-admin token required for platform member audit" }, { "unsupported-platform": "selected tracker does not expose 2FA enrollment status" } ]
- ensures
- [ { "report": "committer 2FA enforcement status and platform setting guidance" } ]
- requires
- [ { "tracker-platform": "github or gitea" }, { "token": "org-admin token when querying member 2FA status" } ]
- namespace
- aiwg
- platforms
- [ "all" ]
- invariants
- [ "tokens are never printed, written, or passed through shell history", "recovery codes are never requested" ]
- commandHint
- { "model": "haiku", "category": "security", "modelRole": "efficiency", "modelTier": "economy", "allowedTools": "Read, Bash", "argumentHint": "[--platform github|gitea] [--org <name>] [--report-only]", "orchestration": false }
- description
- Audit source-control organization settings for strong 2FA/MFA requirements across all committers
02 资源文件 1
- 资产文件assets/browser-check.md460 B
03 SKILL.md 正文
Committer 2FA Audit
Audit whether all committers are covered by strong two-factor authentication policy. This enforces committer-2fa-required and maps curl Practice 25 into source-control governance.
GitHub
Requires an org-admin token supplied outside the prompt context. Query the org member endpoint with the 2FA-disabled filter and report non-compliant users.
Gitea
Gitea support is instance-dependent. When the API exposes 2FA status, report non-compliant users. When it does not, report the configured organization/site policy and mark member-level visibility as unavailable.
Token Handling
Follow token-security: read tokens from a secure environment or secret manager, do not echo them, do not paste them into issue comments, and do not persist audit responses containing token material.
References
agentic/code/frameworks/security-engineering/rules/committer-2fa-required.mdagentic/code/addons/aiwg-utils/rules/token-security.md
04 同仓库更多 Skills
host-hardening
Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.
exposure-analysis
Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.
host-hardening
Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.
exposure-analysis
Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.
fixture-skill
Exercise rule delivery.
pi-local
Pi-local duplicate-precedence fixture.