Github Trending Cn

• Outcome: Pass
• Latest audit: May 28, 2026, 5:44 AM
• Version:
  1.0.0

Overview

This skill is low-risk and self-contained, though it may show sample GitHub trend data rather than live results.

Before installing, understand that this skill appears safe from a security standpoint but may not provide live GitHub Trending data. Treat its results as sample or potentially stale unless the skill is updated to fetch and cite current GitHub data, and be aware that its broad trigger terms may invoke it during general GitHub discussions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger words include very broad terms such as "GitHub", "trending", "开源", and "热门项目", which are likely to match ordinary conversation rather than an explicit request to use this skill. That can cause unintended skill activation and context hijacking, especially in multi-skill environments where common developer discussions may invoke this skill unexpectedly.

VirusTotal

66/66 vendors flagged this skill as clean.