Security audit
Security checks for vulnerabilities and agentic risk
This skill fetches public GitHub Trending pages and formats the results, with no evidence of credential access, persistence, or unrelated local system changes.
Install this if you are comfortable with the skill making live requests to public GitHub Trending pages when invoked. Expect Chinese documentation/output conventions and Beijing-time timestamps; no credentials or local files appear to be needed.
The skill instructs the agent to perform live HTTP scraping against GitHub Trending but does not declare any explicit tool scope or permissions boundaries. In an agent platform, missing network scope metadata can cause unintended or opaque outbound requests, reducing reviewability and making policy enforcement harder.
The natural-language content of the skill file is entirely in Chinese, including the description, usage guidance, and output explanations. This imposes a specific language/locale on users without documenting an opt-in or stating that the skill is intentionally limited to a Chinese-speaking audience.
The HTTP request hard-codes the header "Accept-Language: en-US,en;q=0.9", which forces a specific language/locale preference regardless of the user's own locale. This is a natural-language policy concern because the skill does not offer any language choice or document a justified region-specific requirement.
