9527 Github Trending

每日自动获取 GitHub Trending 热门项目，推送通知。支持自定义语言、时间范围、推送渠道（Telegram/钉钉/企业微信）。零成本运行。

Security Scan

The skill's code and instructions match its description: it scrapes GitHub Trending and posts results to Telegram/DingTalk/WeCom; it requests no unexpected credentials or installs.

Purpose & Capability

The repository, SKILL.md examples, and trending.py implement exactly the advertised functionality (fetch GitHub Trending, format results, send via Telegram/webhook). No unrelated binaries, env vars, or services are requested.

Instruction Scope

SKILL.md only instructs running trending.py and setting up a cron job. One security-relevant note: examples show passing tokens/webhooks on the command line and in crontab, which can expose secrets via process lists or crontab visibility. The instructions do not tell the agent to read unrelated files or secrets.

Install Mechanism

No install spec is provided (instruction-only skill with an included .py). Nothing is downloaded or written by an installer; risk from installation is minimal.

Credentials

The skill requires no declared environment variables; it accepts tokens/webhooks as runtime arguments. That is proportional to its purpose, but passing secrets on command line or crontab is insecure — better to use protected env vars or a config file with restricted permissions.

Persistence & Privilege

The skill does not request persistent presence (always:false) and does not modify other skills or system settings. It runs on demand or via user-configured cron.

Assessment

This skill appears to do what it says, but review and run safely: 1) Inspect trending.py yourself (it performs HTTP requests to github.com and to Telegram/webhook URLs you provide). 2) Do NOT place bot tokens or webhook URLs directly in a public crontab or on the command line (they appear in process lists and some system crontabs); instead use environment variables or a protected config file with restrictive permissions. 3) Verify any webhook endpoints you use are trustworthy and rotate tokens if accidentally exposed. 4) Be aware the script scrapes HTML with regex (fragile) and may break or be rate-limited; consider using the GitHub API or adding retry/backoff if you run it frequently. 5) Run it in a limited user account or isolated environment if you want extra safety.

GitHub Trending 每日推送

自动获取 GitHub Trending 热门项目，推送到你的通知渠道。

功能

• 每日自动获取 GitHub Trending
• 支持过滤编程语言
• 支持多种推送渠道（Telegram、钉钉、企业微信）
• 零成本运行
• 可设置为 Cron 定时任务

快速开始

# 获取今日热门项目
python3 trending.py

# 只看 Python 项目
python3 trending.py --language python

# 推送到 Telegram
python3 trending.py --telegram --token YOUR_BOT_TOKEN --chat_id YOUR_CHAT_ID

# 推送到钉钉
python3 trending.py --dingtalk --webhook YOUR_WEBHOOK_URL

Cron 定时任务

# 每天 9:00 推送
0 9 * * * python3 /path/to/trending.py --telegram --token xxx --chat_id xxx

收入模式

1. 上架 ClawHub 免费分享
2. 提供定制服务（付费）
3. 接受 GitHub Sponsors