Security audit
Security checks for vulnerabilities and agentic risk
This skill simply fetches public GitHub Trending data and does not show credential access, persistence, or destructive behavior.
Install this if you are comfortable with a user-invoked command contacting GitHub's public trending page and producing Chinese-language output. It does not require credentials or make persistent system changes.
Multiple user-facing strings, including the title, usage text, and period labels, are hardcoded in Chinese. The policy requires avoiding forced language or locale unless the skill offers a language choice or clearly documents a justified locale constraint.
The natural-language content of the skill forces a specific language for all user-facing instructions and descriptions. Under the policy, language constraints should be opt-in or clearly justified as region-specific, but this file provides neither.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
echo ""
# 获取并解析数据
curl -s "https://github.com/trending?since=$PERIOD" | python3 -c "
import sys, re
html = sys.stdin.read()
This shell script makes an outbound HTTP request to github.com to retrieve trending data, which is a network operation covered by the missing-warning rule for code files. Although the script's purpose implies fetching remote content, the file does not include an explicit user-facing notice, confirmation, or explanatory comment about contacting GitHub.
No suspicious patterns detected.