Security audit

GitHub Trending Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill fetches public GitHub Trending pages, formats daily or monthly summaries, and writes local cache files; its behavior is disclosed and proportionate.

Before installing, be comfortable with the skill making outbound requests to GitHub Trending and creating or overwriting local cache JSON files. Consider updating the pinned requests dependency and note that the generated summaries are Chinese by design.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该代码的核心行为与“每日 GitHub Trending 热榜推送”部分基本一致：访问 GitHub Trending 页面、解析结果、生成日榜文本，并做缓存容错。但声明中明确提到“支持日榜和月度汇总”，而代码中 URL 固定为 `since=daily`，格式化函数也仅生成“日榜”，不存在任何月度汇总的抓取、聚合、统计或输出逻辑。因此描述高估了实际能力，属于功能性不匹配。未发现额外越权资源访问或与描述无关的主要能力。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description says the skill sends GitHub Trending hotlist updates and supports both daily and monthly summaries. However, this code chunk only tests a parser against hardcoded sample HTML. It does not fetch GitHub data, generate daily or monthly reports, schedule anything, or send any push output. While parser testing could be a supporting implementation detail within such a skill, this specific chunk’s actual behavior is materially narrower and different from the declared end-user purpose, so it is a mismatch for the supplied code chunk.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares executable behavior that includes running local Python scripts and performing network-backed data retrieval, but it does not define any explicit tool scope or permissions boundaries. In an agent environment, missing scope declarations can allow broader-than-expected file, network, or write access, increasing the chance of unauthorized actions or abuse if the implementation changes or is compromised.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The natural-language description states the skill will '推送中文摘要' and later says it returns a 'markdown 格式的中文热榜', which imposes Chinese output by default. This is a language-policy concern because the file does not indicate any user choice or opt-in for output language.

Known Vulnerable Dependency: requests==2.32.3 — 4 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs) +1 more

Medium

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency pins requests to 2.32.3, which is reported to have multiple security advisories, including a .netrc credential leak issue and other vulnerabilities. Even though a trending GitHub skill sounds low-risk, it likely fetches remote content over HTTP(S), so a vulnerable HTTP client library increases exposure to malicious URLs, redirects, or helper-path handling bugs if those code paths are reached.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The skill formats its user-facing output in Chinese literals such as the heading and language label, regardless of user preference. This is a natural-language policy concern because the file hard-codes a specific language without offering an opt-in or alternative locale.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This code hardcodes Chinese-language user-facing text such as fallback descriptions, headers, labels, and failure notes. The file provides no option for the user to choose locale and no justification that the skill is intended only for a Chinese-speaking context, which violates the language/locale policy criterion.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: The manifest description is written as a fixed Chinese-language behavior statement: '每日 GitHub Trending 热榜推送，支持日榜和月度汇总'. Under the policy for natural-language violations, forcing a specific language or locale without user opt-in can be a violation, and this file does not mention any language choice or region-specific justification.

Missing User Warnings

Low

Confidence: 79% confidence
Finding: This code performs a network request in fetch_html and sends a custom User-Agent header, but the file contains no comment, docstring, log message, or prompt disclosing that outbound HTTP requests occur. For code files, network calls that transmit system or user data should have some visible warning unless clearly documented elsewhere, which is not shown in this file.

Missing User Warnings

Low

Confidence: 72% confidence
Finding: The save_cache function writes data to disk, but this file provides no confirmation, logging, docstring, or comment indicating that local files will be created or overwritten. File writes are in scope for missing-warning checks in code files when there is no visible disclosure.

Static analysis

No suspicious patterns detected.