evaluate-repository

Evaluate Repository

When to Use

• Before merging a dependency or forked repository into your project
• As part of a security review gate before production deployment
• When onboarding a new open-source project — quick trust assessment
• Periodic audits of your own repository for hygiene regressions
• Before granting broad write, review, or merge autonomy to a coding agent

Prerequisites

• Read access to the repository (no write access required)
• gh CLI or Copilot GitHub MCP for fetching issue/PR history (optional, enriches results)

Workflow

1. Establish Scope

# Confirm what's being evaluated
git --no-pager log --oneline -10
git --no-pager tag --sort=-creatordate | Select-Object -First 5

# Find sensitive file categories
git ls-files | Where-Object { $_ -match '\.(env|pem|key|p12|pfx|secret)$' }
git ls-files | Where-Object { $_ -match '(secret|credential|password|token)' -and $_ -notmatch 'test|spec|mock' }

2. Score Each Dimension (1–10)

For each dimension below, assign a score and list specific findings:

Dimension 1: Secrets & Credentials

# Scan for hardcoded secrets patterns
git --no-pager grep -in "password\s*=\s*['\"][^'\"]" -- "*.ts" "*.js" "*.py" "*.go"
git --no-pager grep -in "api_key\s*=\s*['\"][^'\"]"
git --no-pager grep -in "secret\s*=\s*['\"][^'\"]"

# Check .gitignore covers sensitive files
Get-Content .gitignore | Select-String "\.env|\.pem|\.key|secret"

Red flags (score → 1–3):

• Hardcoded passwords, API keys, tokens in source
• .env or .pem files committed (not in .gitignore)
• AWS/GCP/Azure credentials in any file

Dimension 2: Dependency Security

# Node.js
npm audit --audit-level=high 2>&1 | Select-Object -Last 20

# Python
pip-audit 2>&1 | Select-Object -Last 10

# Check for very outdated dependencies
npm outdated 2>&1 | Select-Object -First 20

Red flags (score → 1–3):

• Known CVEs in direct dependencies (high/critical severity)
• Dependencies last updated >2 years ago with no security patch history
• No lock file (package-lock.json, poetry.lock, go.sum)