Security audit
Security checks for vulnerabilities and agentic risk
This skill is a read-only AppOrbit data lookup helper that fetches public ranking and metadata from disclosed sources without hidden persistence or destructive behavior.
Install only if you are comfortable with a Node.js helper making read-only network requests to GitHub and the AppOrbit website. Avoid setting APPORBIT_SOURCE or APPORBIT_SITE_DIR to untrusted data, because those inputs control what dataset the helper reads and analyzes.
Referenced artifact was not completely inspected
Use the read-only helper in this skill's `scripts/query.mjs` for deterministic selection and calculations. Run the examples below from this skill's directory, o
Referenced artifact was not completely inspected
Use the read-only helper in this skill's `scripts/query.mjs` for deterministic selection and calculations. Run the examples below from this skill's directory, o
Referenced artifact was not completely inspected
Use the read-only helper in this skill's `scripts/query.mjs` for deterministic selection and calculations. Run the examples below from this skill's directory, o
Referenced artifact was not completely inspected
Use the read-only helper in this skill's `scripts/query.mjs` for deterministic selection and calculations. Run the examples below from this skill's directory, o
Referenced artifact was not completely inspected
Use the read-only helper in this skill's `scripts/query.mjs` for deterministic selection and calculations. Run the examples below from this skill's directory, o
Referenced artifact was not completely inspected
Use the read-only helper in this skill's `scripts/query.mjs` for deterministic selection and calculations. Run the examples below from this skill's directory, o
Referenced artifact was not completely inspected
Use the read-only helper in this skill's `scripts/query.mjs` for deterministic selection and calculations. Run the examples below from this skill's directory, o
The skill explicitly instructs use of Node, shell commands, environment-controlled behavior, and remote network access, but it does not declare any tool restrictions or permission scope. That leaves the runtime with implicit broad capabilities, increasing the chance of unintended shell execution, unreviewed outbound requests, or abuse via attacker-controlled inputs such as APPORBIT_SOURCE or proxy-related fallback behavior.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
The default ranking source is `https://raw.githubusercontent.com/ivershuo/apporbit/data/v1/`. Set `APPORBIT_SOURCE` or pass `--source` to use a fork's raw `data/v1/` URL or an absolute path to a local `v1` data directory. Under the bundled v1 contract, the source contains `views/agent-index-v1.json`, generated automatically by the collection workflow. If it is absent, follow the format-recovery steps below before concluding that the next collection must build it. The helper can still return ranks and movement when website metadata is temporarily unavailable; names then appear as `null` with a `metadataWarning`.
Before interpreting or analyzing records, read this skill's bundled [data format v1](references/data-format.md) in full. It defines the paths, record fields, index, quality statuses, and time rules needed to interpret the data correctly, and links to the published schemas for exact field types. Resolve field meanings from that reference yourself; give the user the analysis and relevant source links, without asking them to read the format document.
### Recover from a stale or incorrect bundled format
No suspicious patterns detected.