ClawHub
Back to skill

Security audit

github-trending

Security checks across malware telemetry and agentic risk

Overview

This skill fetches public GitHub Trending pages and formats trend reports without accessing private data, credentials, or persistent system settings.

Installers should understand that this skill runs local Python code and makes outbound requests to public GitHub pages. It does not appear to use private data or credentials, but its results depend on GitHub’s page structure and network availability.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Low
Confidence
89% confidence
Finding
Line L08 includes the Chinese phrase "榜单" inside an otherwise English instruction sentence. This introduces a language-specific output/instruction element without an explicit user choice or a documented reason that the skill is intended for a Chinese locale.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.