Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only repository analysis skill whose network and file access are expected for its stated purpose, though users should be aware it queries GitHub and may read a supplied local repository path.
Install only if you are comfortable with the agent querying GitHub for repository metadata and file listings when given a GitHub URL, and with it reading files under a local path you explicitly provide. Avoid pointing it at directories that contain unrelated private material.
The skill references capabilities that imply reading local files, accessing network resources, and invoking scripts, but it does not declare any explicit tool scope or permission boundaries. This increases the risk of overbroad execution, especially when analyzing local paths or GitHub URLs, because the agent may access more data or perform more actions than the user reasonably expects.
The activation text is broad enough to trigger on many generic repository-related requests, which can cause the skill to run in contexts the user did not specifically intend. Overbroad triggering is dangerous because it may lead to unnecessary file access, network retrieval, or automated analysis without sufficiently clear consent or scope.
The execution strategy instructs automatic analysis of GitHub URLs and local paths, including running an analysis script, without telling users that repository metadata and local file contents may be accessed. This is dangerous because it can expose sensitive local data or retrieve remote content without informed consent, especially when a user provides a local path casually.
This markdown file uses Chinese throughout, beginning with the title at L001, and does not indicate that the skill is region-specific or that users can opt into another language. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
The skill performs outbound requests to GitHub APIs and raw content endpoints without any user-facing disclosure, confirmation, or policy gating in the active path. In an agent setting, this can unintentionally transmit user-supplied repository targets and trigger external network access in contexts where users expect local-only analysis.
This code transmits repository identifiers to GitHub's API to fetch README content. In the context of an agent skill, external transmission is security-relevant because it causes network egress and may disclose user interest, private infrastructure naming, or sensitive repository references if misused with non-public targets.
def fetch_github_readme(owner: str, repo: str) -> str:
"""通过 GitHub API 获取 README 内容"""
api_url = f"https://api.github.com/repos/{owner}/{repo}/readme"
try:
req = urllib.request.Request(api_url, headers={"Accept": "application/vnd.github.v3.raw"})
with urllib.request.urlopen(req, timeout=15) as resp:
This request fetches repository metadata from GitHub and therefore sends user-specified repository coordinates to an external service. In a read-only analysis skill, such egress may be acceptable functionally, but without notice and policy control it remains a real information-disclosure and network-boundary concern.
def fetch_github_repo_info(owner: str, repo: str) -> dict:
"""通过 GitHub API 获取仓库元数据"""
api_url = f"https://api.github.com/repos/{owner}/{repo}"
try:
req = urllib.request.Request(api_url)
with urllib.request.urlopen(req, timeout=15) as resp:
The code issues another outbound GitHub API request to determine repository information, contributing to unannounced network egress. Repeated external calls increase exposure to privacy leakage, rate limiting, and operational surprises in environments expecting offline or least-privilege behavior.
def fetch_github_tree(owner: str, repo: str, branch: str = "main") -> list:
"""通过 GitHub API 获取仓库文件树（前100个文件）"""
# 先尝试获取默认分支
info_url = f"https://api.github.com/repos/{owner}/{repo}"
try:
req = urllib.request.Request(info_url)
with urllib.request.urlopen(req, timeout=10) as resp:
Fetching the full repository tree via GitHub API is an external transmission of user-selected repository context and can reveal analysis targets to a third party. In this skill context, that is more sensitive than in a normal standalone CLI because an agent may perform the action automatically on behalf of a user without an explicit network boundary warning.
except Exception:
pass
tree_url = f"https://api.github.com/repos/{owner}/{repo}/git/trees/{branch}?recursive=1"
try:
req = urllib.request.Request(tree_url)
with urllib.request.urlopen(req, timeout=15) as resp:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
tmpdir = tempfile.mkdtemp(prefix=f"repo_analysis_{repo}_")
clone_url = f"https://github.com/{owner}/{repo}.git"
print(f"Cloning {clone_url} ...", file=sys.stderr)
subprocess.run(
["git", "clone", "--depth", "1", clone_url, tmpdir],
capture_output=True,
check=True,
This skill is intended to read and understand repositories, but the implementation contains broader capability to clone repositories to a temporary directory and process them locally. Even if the main path currently prefers API-only analysis, retaining latent clone functionality expands the attack surface and could be triggered by future code changes, alternate callers, or local-path usage of untrusted repositories.
The activation and usage instructions are presented in Chinese, which effectively imposes a language preference on users. There is no explicit opt-in, alternative language support, or documented justification for limiting the skill to a Chinese-speaking audience.
The script's natural-language documentation, including its title, feature list, and usage description, is presented in Chinese only. Under the language/locale policy, forcing a specific language without offering choice or documenting a justified locale constraint is a policy issue.
The standalone docstring at L247 states that GitHub URLs are cloned into a temporary directory, implying clone-based behavior for remote repositories. But analyze_repo explicitly prefers analyze_github_remote for valid GitHub URLs and returns before any clone path is reached, so the documentation contradicts the actual behavior of the primary remote path.
No suspicious patterns detected.