What problem does it solve? Evaluating a third-party GitHub repository before adoption requires manually checking its license terms, dependency vulnerabilities, hardcoded secrets, and maintenance health, which is slow and error-prone when done from memory. ## Core Features & Use Cases - License Detection & Verdict: Fetches the actual LICENSE text (robust to GitHub API rate limits via raw file fallback), classifies it into categories like permissive, copyleft, or source-available, and issues a compatibility verdict for a commercial closed-source SaaS. - Trivy Security Scan: Runs trivy repo to bucket CVEs, secrets, and IaC misconfigurations by severity, with conservative thresholds producing a safe / caution / unsafe verdict; can also parse an existing CI-generated Trivy JSON report offline. - Adoption Briefing: Produces a structured Markdown briefing covering what the project is, the problem it solves, maintenance pulse, external reviews, and a combined license-plus-security verdict. - Use Case: A teammate pastes a GitHub URL and asks "can we use this at Growmax?" — the skill returns a snapshot table, severity counts, license obligations, and one bottom-line recommendation. ## Quick Start Analyze the GitHub repository at https://github.com/owner/repo and tell me whether it is safe for us to adopt, including its license and any vulnerabilities.
