github-org-audit-runnerlisted

# github-org-audit-runner A Category 3 ops tool. The org's admin settings are a control surface auditors and security architecture care about. This skill makes the audit reproducible: same checks every time, same baseline, structured output. ## When to use - Quarterly admin review (the cadence you'd use for `ghas-config-reviewer` but at org level). - Before audit conversations needing documented org posture. - Troubleshooting an org-wide-policy-induced issue (a team complaining their Action isn't allowed, a user complaining they can't push to a public fork). - After a major GitHub product change that affects admin settings (model selection, AI policy, residency). ## When NOT to use - Repo-level GHAS configuration → `ghas-config-reviewer`. - Workflow security → `actions-workflow-hardener`. - Specific user / membership questions → `enterprise-audit-log-investigator`. - Copilot-specific policy → `copilot-faq-answerer` for the question, this skill for the org settings backing it. ## Baseline (the org's expected state) Per category. Severities apply if the current state diverges. ### Identity & access | Setting | Expected | Severity if missing | |---------|----------|---------------------| | SAML SSO enforced | yes | CRITICAL | | SCIM provisioning enabled | yes | HIGH | | EMU (Enterprise Managed Users) posture | enabled for in-scope org(s) | HIGH | | Two-factor required for non-SAML members | yes | CRITICAL | | Outside collaborators allowed | no (or org-policy-approved ex