Security audit
Security checks for vulnerabilities and agentic risk
This skill is a repository health checklist that reads project files and optional GitHub metadata to produce a score, with no evidence of hidden persistence, credential theft, or destructive behavior.
Installers should expect this skill to inspect repository files and git history and, when the GitHub CLI is available, optionally query GitHub for public community metrics. Use it in repositories where local structure and remote repository identity are acceptable inputs for a health score.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# .gitignore quality
if [ -f ".gitignore" ]; then
SCORE=$((SCORE + 1))
grep -q "\.env" .gitignore && SCORE=$((SCORE + 1))
grep -q "node_modules\|vendor\|__pycache__" .gitignore && SCORE=$((SCORE + 1))
fi
The documentation states the skill is 'purely static analysis,' but the implementation performs live GitHub queries via gh repo view. This mismatch is security-relevant because users may approve the skill under a false assumption that it has no network behavior, leading to trust boundary violations and unintended outbound requests.
The skill invokes gh repo view to fetch live repository metadata, which expands behavior beyond local static inspection into network-dependent data access. In constrained or privacy-sensitive environments, this can leak contextual information about the target repository, produce non-deterministic results, and violate user expectations that the skill only inspects local files.
No suspicious patterns detected.