GitHub Trending Skill
PassAudited by ClawScan on May 3, 2026.
Overview
This skill appears to fetch public GitHub Trending pages and return Chinese summaries, with only minor caveats about untrusted web content, local caching, and incomplete source/install metadata.
This looks safe for normal use if you are comfortable with it fetching public pages from GitHub and caching public results locally. Treat returned repository descriptions as web content, not instructions, and verify the source/publisher if you require strong provenance.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A repository description from GitHub could theoretically contain text that looks like instructions to the agent, though the skill does not tell the agent to obey it.
Fetched third-party GitHub page content, including repository descriptions, is embedded into the Markdown response. This is expected for a trending-summary skill, but that text should be treated as data rather than instructions.
html = fetch_html(url)
items = parse_trending(html)
...
f"{idx}. **{name}** - {description} "Treat repository names and descriptions as untrusted web content; do not follow instructions that appear inside trending results.
Users have less registry-level provenance information to verify who maintains the skill or how dependencies are expected to be installed.
The registry-level source and install metadata are incomplete even though the package contains executable Python scripts and dependencies. The included code is readable and dependencies are pinned, so this is a provenance/setup note rather than a concern.
Source: unknown Homepage: none No install spec — this is an instruction-only skill.
Verify the publisher or repository if provenance matters, and install only the pinned dependencies shown in requirements.txt.
If cached public web data becomes stale or contains misleading text, it may be shown again during a later network failure.
The skill stores fetched trending results and may reuse cached results after a network failure. The cached data is public GitHub Trending content and is scoped to the skill directory.
CACHE_PATH = Path(__file__).resolve().parent / "cache_daily.json"
...
save_cache(CACHE_PATH, payload)
...
return format_daily(cached["items"], cached.get("language", language), limit) + noticeUse the cache only as a fallback, and clear the skill's cache files if stale or suspicious results appear.