# GitHub Agent Skill Inventory & Drift Report (`bread-kim/github-agent-skill-inventory-drift-report`) Actor

Inventory agent skills from public GitHub repositories without installing or executing them. Extract descriptions, tools, licenses, and related files, detect duplicates and drift from a prior snapshot, and export JSON, CSV, and ZIP reports.

- **URL**: https://apify.com/bread-kim/github-agent-skill-inventory-drift-report.md
- **Developed by:** [bread kim](https://apify.com/bread-kim) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$50.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## GitHub Agent Skill Inventory & Drift Report

A private Apify Actor that inventories `SKILL.md` declarations from one or two explicitly named **public** GitHub repositories. Each observation is pinned to an immutable commit and verified Git blob. The Actor produces normalized JSON, formula-safe CSV, escaped Markdown, a reusable baseline, a hash manifest, and a deterministic ZIP. It never installs or executes a skill.

### Input

- `demoMode` (default `false`): uses an internal deterministic fixture and performs zero DNS/HTTP requests.
- `repositories`: 1–2 exact `owner/repo` names in live mode. URLs, private repositories, renamed redirects, credentials, and arbitrary hosts are rejected.
- `maxSkills`: global limit of 1–15 skills across all requested repositories, default 10.
- `baseline`: up to 100 exact prior records. Missing skills become `REMOVED` only after a complete scan of that same requested repository.

Try [examples/input.json](examples/input.json). The live canary input is [canary_input.json](canary_input.json) and requests the first stable-sorted skill from `anthropics/skills`; canary validation requires at least one `VALID` metadata extraction.

### Output

Successful runs write exactly one authoritative dataset record and the same record under `OUTPUT`. The record contains status, completeness, bounded warnings, commit/blob provenance, declared metadata/tools/licenses, companion paths, duplicate-hash evidence, changes, and ZIP evidence. Official optional string-to-string `metadata` maps are accepted after bounded validation but are not exported. Suspected credentials in exported declarations are replaced with a fixed redaction marker. Failed input or an all-repository failure writes a safe `FAILED` `OUTPUT` record and no success dataset row; a verified complete public repository with no skills remains a valid empty result.

Artifacts are `INVENTORY.json`, `SKILLS.csv`, `REPORT.md`, `BASELINE.json`, `MANIFEST.json`, and `GITHUB_AGENT_SKILL_REPORT.zip`. The ZIP contains the first five fixed paths; the manifest hashes all included files except itself, then is added as the fifth entry.

`NOT_LEGAL_ADVICE`: repository and frontmatter licenses are separate declarations, not legal clearance. Public availability does not grant unrestricted reuse. Verify every license with the repository owner.

### Local QA

Requires exactly Node.js 22.23.3.

```sh
npm ci --ignore-scripts
npm run preflight
```

Container startup has a dedicated no-network path: `AUTOMATON_CONTAINER_SMOKE=1`. No token is accepted or needed. See [SECURITY_REVIEW.md](SECURITY_REVIEW.md) for the trust boundary and [SUPPORT.md](SUPPORT.md) for status meanings.

# Actor input Schema

## `demoMode` (type: `boolean`):

Run a fixed internal fixture with no DNS or HTTP requests.

## `repositories` (type: `array`):

One or two exact public owner/repository names. Required outside demo mode.

## `maxSkills` (type: `integer`):

Global maximum of stable sorted SKILL.md files fetched across all repositories.

## `baseline` (type: `array`):

Caller-supplied prior inventory entries used only for conservative drift comparison.

## Actor input object example

```json
{
  "demoMode": true,
  "repositories": [],
  "maxSkills": 10,
  "baseline": []
}
```

# Actor output Schema

## `output` (type: `string`):

Exact authoritative result also written once to the dataset on success.

## `inventory` (type: `string`):

Bounded metadata and provenance inventory.

## `skillsCsv` (type: `string`):

Formula-neutralized tabular inventory.

## `report` (type: `string`):

Escaped human-readable report.

## `baseline` (type: `string`):

Normalized baseline for a later run.

## `manifest` (type: `string`):

SHA-256 and size evidence for files inside the ZIP.

## `zip` (type: `string`):

Deterministic report bundle.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "demoMode": true,
    "repositories": []
};

// Run the Actor and wait for it to finish
const run = await client.actor("bread-kim/github-agent-skill-inventory-drift-report").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "demoMode": True,
    "repositories": [],
}

# Run the Actor and wait for it to finish
run = client.actor("bread-kim/github-agent-skill-inventory-drift-report").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "demoMode": true,
  "repositories": []
}' |
apify call bread-kim/github-agent-skill-inventory-drift-report --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,bread-kim/github-agent-skill-inventory-drift-report"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/UOUo9dJIVfTTZ03z4/builds/m6H4TU1crslDc1r94/openapi.json