Andrew Borden-Chisholm

Catalog / Tools

OpenSSF Scorecard

Scores a GitHub or GitLab repository on security practices — branch protection, pinned dependencies, signed releases, dangerous workflows, maintenance — so you can judge where a skill comes from.

Install

  1. No install

    Look up any regularly scanned repo at scorecard.dev/viewer/?uri=github.com/<owner>/<repo>

  2. CLI

    brew install scorecard

    Set GITHUB_AUTH_TOKEN first. Unauthenticated GitHub API calls hit rate limits.

  3. Score a repo

    scorecard --repo=github.com/<owner>/<repo> --show-details

The scanners in this catalog look at a skill’s contents. Scorecard looks at the repository it came from: is the maintainer’s branch protected, are CI actions pinned, are releases signed, has anyone committed in months?

When to use it

  • A skill or MCP server scans clean but comes from an account you don’t know.
  • You want a quick maintenance signal before you depend on a repo.
  • Your own skills repo: the Scorecard GitHub Action publishes a badge and flags regressions.

How to read it

Scores run 0–10 per check. A low score means weak practices, not that anything is malicious. Many solo skill repos score low on branch protection and code review.

Publisher
OpenSSF
Source
github.com/ossf/scorecard
Works with
Any agent
Categories
Security & trust
License
Apache-2.0
Cost
Free

Curated by Andrew Borden-Chisholm. Notes on building with these tools are on the blog.