Github Rising Stars

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:27 PM UTC
• Version:
  1.0.0

Overview

This is a small GitHub discovery helper that contacts GitHub when invoked and does not show hidden persistence or destructive behavior.

Reasonable to install for finding rising GitHub projects. Expect the agent to contact GitHub when you invoke it, and avoid hard-coding a personal access token into the script unless you understand the exposure risk.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs the agent to run a bundled Python script that queries the GitHub Search API, which is a network-capable action, yet the skill metadata does not declare any corresponding permission. This creates a transparency and policy-enforcement gap: agents or reviewers may underestimate the skill's external data access, and permission controls cannot be applied correctly.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The trigger list includes broad phrases such as requests about 'fast growing repos' or GitHub projects that could match ordinary repository-discovery queries beyond the intended niche. Over-broad activation can cause the wrong skill to run unexpectedly, leading to unintended network calls and surprising behavior for users.

VirusTotal

64/64 vendors flagged this skill as clean.