Security audit
Security checks across malware telemetry and agentic risk
This GitHub automation skill is mostly purpose-aligned, but it includes an under-scoped history-cleaning command that can rewrite and force-push all branches and tags without confirmation.
Install only if you intentionally need GitHub automation with administrative repository powers. Use least-privilege GitHub tokens, avoid delete or force-push permissions unless required, verify IM webhook/API destinations, and do not run the clean/history feature unless you have backups and are prepared for all branches and tags to be rewritten.
'--index-filter', f'git rm --cached --ignore-unmatch {file_path}',
'--prune-empty', '--tag-name-filter', 'cat', '--', '--all'
]
subprocess.run(cmd, check=True, capture_output=True)
# 强制推送到远程
subprocess.run(['git', 'push', 'origin', '--force', '--all'], check=True, capture_output=True)subprocess.run(cmd, check=True, capture_output=True)
# 强制推送到远程
subprocess.run(['git', 'push', 'origin', '--force', '--all'], check=True, capture_output=True)
subprocess.run(['git', 'push', 'origin', '--force', '--tags'], check=True, capture_output=True)
# 清理临时目录# 强制推送到远程
subprocess.run(['git', 'push', 'origin', '--force', '--all'], check=True, capture_output=True)
subprocess.run(['git', 'push', 'origin', '--force', '--tags'], check=True, capture_output=True)
# 清理临时目录
os.chdir('..')"type": "text",
"content": message
}
response = requests.post(f"{api_url}/bot/send", json=payload)
response.raise_for_status()
return "消息已发送到微信""text": message
}
}
response = requests.post(self.feishu_webhook_url, json=payload)
return response.json()
return {"error": "FEISHU_WEBHOOK_URL not set"}
```64/64 vendors flagged this skill as clean.
No suspicious patterns detected.