Security audit
Security checks for vulnerabilities and agentic risk
This skill fetches public GitHub Trending pages to summarize open-source trends, with no hidden code, persistence, credential use, or local data access found.
Installers should understand this skill may browse public GitHub Trending when a question sounds like a GitHub or open-source trend request. It does not ask for private access or make changes, but tighter trigger wording would reduce accidental activation on broad technology-trend questions.
The trigger description contains broad, everyday phrases such as asking what is hot today or discussing technology trends, which can cause the skill to activate outside narrowly intended GitHub-trending requests. This increases the chance of unintended invocation, unnecessary web access, and misrouting user queries into this skill when a general response would be more appropriate.
The eval prompts are phrased as ordinary user requests such as asking what is hot on GitHub today, without strong trigger boundaries that distinguish evaluation cases from routine conversation. In a skill-routing system, this can cause the skill to activate too broadly, increasing the chance of unintended data fetching, over-invocation, or routing conflicts with other skills handling general trend or recommendation queries.
The expected outputs require a Chinese report for one prompt and an English report for another, but the file does not state a language-selection policy or user opt-in mechanism. This can indicate a locale/language policy issue because output language is being forced by configuration rather than explicitly offered as a choice.
No suspicious patterns detected.
