GitHub Automation Pro

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:55 PM UTC
• Version: 1.0.0

Overview

This GitHub automation skill is purpose-aligned, but it warrants Review because token-backed GitHub write code is intentionally obfuscated and its memory-security claim is unsupported.

Install only after reviewing the obfuscation risk. Use a fine-grained, least-privilege GitHub token limited to the target repositories, avoid broad organization or classic tokens, and be prepared to revoke the token if behavior is unexpected.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: GitHubSkill.js:1

Finding

Deliberate Obfuscation and Anti-Analysis Logic Conceal Security-Critical Behavior

Content

View full analysis

Vulnerability Details

File Location: GitHubSkill.js:1, index.js:1, api/GitHubClient.js:1, strategies/IssueStrategies.js:1, strategies/PRStrategies.js:1, strategies/ReleaseStrategies.js:1, strategies/index.js:1, and package.json:43-44
Vulnerability Type: Deliberate code obfuscation and anti-analysis controls
Risk Level: High

Vulnerable Code

All executable JavaScript files are compressed onto a single line. Representative code from GitHubSkill.js:1:

javascript

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));
const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),
a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});
a0_0x1e773f();

Representative self-defending expression found in the obfuscated string tables:

javascript

'(((.+)+)+)+$'

The package metada ...[truncated 2293 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish readable, non-obfuscated source for every executable module.
2. Remove self-defending regular expressions, opaque control flow, rotating string tables, and anti-analysis bootstrap code.
3. Include source maps that correspond exactly to the distributed JavaScript.
4. Use reproducible builds and publish build instructions so consumers can verify that packaged artifacts were produced from reviewed source.
5. Sign release artifacts and publish cryptographic checksums or provenance attestations.
6. Add automated review gates that compare the published npm package against the source repository.
7. Keep security-critical token handling and GitHub API calls straightforward and independently testable.

T09 · Insecure Skill Coding Practices

Warning

• Location: api/GitHubClient.js:1

Finding

GitHub Access Token Is Retained in Plaintext Despite In-Memory Encryption Claim

Content

View full analysis

Vulnerability Details

File Location: api/GitHubClient.js:1, GitHubSkill.js:1, and SKILL.md:214-218
Vulnerability Type: Plaintext retention of sensitive authentication material and inaccurate security documentation
Risk Level: Medium

Vulnerable Code

The GitHub client retains the original token directly in an instance field in api/GitHubClient.js:1:

javascript

class a1_0x3681d8{
  [a1_0x17a441(0xfb)];
  [a1_0x17a441(0x101)];
  constructor(_0x176d36){
    const _0x13d125=a1_0x17a441;
    this['_token']=_0x176d36;
    const _0x30cf3d={};
    _0x30cf3d[_0x13d125(0x10e)]=_0x176d36;
    this['octokit']=new a1_0x2550c2[(_0x13d125(0x10f))](_0x30cf3d);
  }
  [a1_0x17a441(0xfc)](){
    const _0x3d1300=a1_0x17a441,_0x5586e1={};
    _0x5586e1[_0x3d1300(0xf9)]=function(_0x98033d,_0x446e5f){return _0x98033d+_0x446e5f;},
    _0x5586e1[_0x3d1300(0xbb)]=_0x3d1300(0xc9);
    const _0x5241af=_0x5586e1;
    return _0x5241af[_0x3d1300(0xf9)](
      this[_0x3d1300(0x101)][_0x3d1300(0xf7)](0x0,0x4)+_0x5241af[_0x3d1300(0xbb)],
      this['_token'][_0x3d1300(0xf7)](this[_0x3d1300(0x101)][_0x3d1300(0xf1)]-0x4)
    );
  }
}

The main skill also keeps the complete configuration, including githubToken, in GitHubSkill.js:1:

javascript

async[a0_0x1abc6f(0x1b8)](_0x1e2231){
  const _0x2b1768=a0_0x1abc6f,_0x3896d8={};
  _0x3896d8[_0x2b1768(0x235)]='GitHub\x20token\x20is\x20required',
  _0x3896d8[_0x2b1768(0x19d)]=_0x2b1768(0x18e),
  _0x3896d8[_0x2b1768(0x1a5)]=_0x2b1768(0x144),
  _0x3896d8[_0x2b1768(0x1d8)]=_0x2b1768(0x153);
  const _0x4e43f0=_0x3896d8;
  this['config']=_0x1e2231;
  this[_0x2b1768(0x193)]=new a0_0x327bcf['GitHubClient'](_0x1e2231['githubToken']);
  try{
    await this['client'][_0x2b1768(0x221)]();
  }catch(_0x4afebe){
    if(_0x4e43f0[_0x2b1768(0x19d)]!==_0x4e43f0['PgWIy'])
      throw new Error(_0x4e43f0[_0x2b1768(0x1d8)]);
  }
}

The ...[truncated 2506 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unsupported claim that sensitive data is encrypted in memory, or implement a clearly documented credential-protection design.
2. Avoid retaining the full initialization configuration after setup. Copy only non-sensitive fields into persistent skill state.
3. Do not maintain an additional _token copy solely to support getToken(). If token identification is necessary, store only a non-sensitive fingerprint or short prefix.
4. Keep credentials in the narrowest-lived component and avoid exposing credential-bearing objects through public APIs.
5. Clear references during dispose() and after failed initialization. Although JavaScript cannot guarantee immediate memory erasure, removing references reduces retention.
6. Prefer short-lived GitHub App installation tokens or fine-grained personal access tokens over long-lived classic personal access tokens.
7. Require least-privilege repository and operation scopes and document the exact permissions needed for each feature.
8. Prevent credentials and configuration objects from being serialized, logged, included in errors, or captured in telemetry.
9. Add tests that inspect public outputs and error paths to ensure the raw token is never returned.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (188)

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The file is heavily obfuscated, which prevents meaningful review of the exact runtime behavior and can conceal unsafe logic, hidden side effects, or anti-analysis code. In a privileged GitHub automation skill that accepts a personal access token and performs write operations, obscurity materially increases the chance that dangerous behavior could be hidden from maintainers and users.

Content

Scanner excerpt · GitHubSkill.js (reported line 1)May include surrounding context.

js

const a0_0x1abc6f=a0_0x5433;(function(_0x2811b6,_0x12811a){const _0x213b86=a0_0x5433,_0x56caea=_0x2811b6();while(!![]){try{const _0x45c0a0=-parseInt(_0x213b86(0x20f))/0x1*(parseInt(_0x213b86(0x183))/0x2)+-parseInt(_0x213b86(0x181))/0x3*(-parseInt(_0x213b86(0x187))/0x4)+-parseInt(_0x213b86(0x15e))/0x5+parseInt(_0x213b86(0x204))/0x6*(parseInt(_0x213b86(0x213))/0x7)+parseInt(_0x213b86(0x167))/0x8+parseInt(_0x213b86(0x15f))/0x9+parseInt(_0x213b86(0x206))/0xa*(-parseInt(_0x213b86(0x145))/0xb);if(_0x45c0a0===_0x12811a)break;else _0x56caea['push'](_0x56caea['shift']());}catch(_0x296b58){_0x56caea['push'](_0x56caea['shift']());}}}(a0_0x267b,0x781bd));const a0_0x2d9fce=(function(){let _0x50114b=!![];return function(_0x5882e4,_0x30a11f){const _0x52ad5e=_0x50114b?function(){const _0xbaaa31=a0_0x5433;if(_0x30a11f){const _0x15c865=_0x30a11f[_0xbaaa31(0x17d)](_0x5882e4,arguments);return _0x30a11f=null,_0x15c865;}}:function(){};return _0x50114b=![],_0x52ad5e;};}()),a0_0x1e773f=a0_0x2d9fce(this,function(){const _0x1d2a59=a0_0x5433,_0x4b1b26={};_0x4b1b26[_0x1d2a59(0x23d)]=_0x1d2a59(0x164);const _0x251a61=_0x4b1b26;return a0_0x1e773f[_0x1d2a59(0x209)]()[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)])[_0x1d2a59(0x209)]()[_0x1d2a59(0x1cd)](a0_0x1e773f)[_0x1d2a59(0x1ed)](_0x251a61[_0x1d2a59(0x23d)]);});a0_0x1e773f();'use strict';const a0_0x34e96c={};a0_0x34e96c[a0_0x1abc6f(0x19f)]=!![],Object[a0_0x1abc6f(0x1fd)](exports,a0_0x1abc6f(0x217),a0_0x34e96c),exports[a0_0x1abc6f(0x228)]=exports['SkillConfigBuilder']=void 0x0,exports[a0_0x1abc6f(0x1a0)]=a0_0x57e04d;const a0_0x4ef596=require('./strategies'),a0_0x327bcf=require('./api/GitHubClient');function a0_0x267b(){const _0x9763cf=['EXECUTION_ERROR','RFhbi','XRmYd','UuVQk','Created\x20issue\x20details','WEBls','iqtkR','NlBRi','constructor','object','tHcyB','qMZmL','pOkDc','Create\x20a\x20new\x20release','tikta','Ccykf','prerelease','KFckv','repoAnalytics','CpUNY','features','HiKiw','repo.health','pr.analyze','grZtF','1.0.0','gNpUm','code','iMb
...[truncated 27 chars]

Static analysis

No suspicious patterns detected.