Security audit
Security checks for vulnerabilities and agentic risk
This skill transparently manages GitHub resources with a user-provided token, including clearly warned repository deletion that requires confirmation.
Install only if you are comfortable giving the skill a GitHub token. Use a fine-grained token limited to the repositories and actions you need, review repository deletion carefully, and prefer upgrading python-dotenv before use.
The script reads a GitHub token from environment variables via os.getenv/load_dotenv, but the declared permissions do not disclose environment access. In an agent-skill context, undeclared secret access is dangerous because it can silently consume credentials beyond what a reviewer expects, expanding the trust boundary and enabling unintended use of sensitive tokens for destructive GitHub operations.
The dependency is pinned to python-dotenv 1.0.1, which is reported as vulnerable to a symlink-following issue in set_key that can enable arbitrary file overwrite when modifying .env files. In a GitHub operations skill with repository write and external network permissions, any code path that updates environment files or handles attacker-controlled repository content could make this easier to trigger and increase operational risk.
This code file performs network/API calls that send user-supplied repository metadata and content to GitHub, but most mutating operations only have internal docstrings/comments and no visible user-facing notice at execution time. Under SQP-2 for code files, network calls that transmit user or system data should have some disclosure unless the warning is provided elsewhere, which is not shown in this file.
The manifest description says the skill supports CRUD operations for repositories, branches, PRs, and issues. In the actual code, repositories have create/read/list/delete support, but branches only support create/list, PRs only support create/list, and issues only support create/list; update and delete operations are absent for those resource types. This creates a semantic mismatch between the claimed capability scope and implemented behavior.
The description contains Chinese text followed by an English instruction ('Do NOT use for repository cloning.') even though the policy requires flagging forced language or locale behavior without user opt-in. The file consistently presents the skill in Chinese while introducing an English-only constraint, and it does not state that users may choose their preferred language.
The manifest description is primarily in Chinese but includes the directive "Do NOT use for repository cloning." only in English. This creates a language-policy inconsistency because the skill communicates an important usage constraint in a language that may not match the rest of the user-facing metadata, without offering locale choice or opt-in.
Natural-language strings throughout the file, including the top-level description and command help, are presented in Chinese with no indication that the user can select another language. This is a language/locale policy concern because the skill imposes a specific locale without opt-in or a documented region-specific requirement.
No suspicious patterns detected.
