Security audit
Security checks for vulnerabilities and agentic risk
This skill behaves like a disclosed GitHub digest tool, but it stores local tokens and can schedule recurring delivery if the user enables it.
Install only if you are comfortable storing narrowly scoped GitHub, Telegram, or Resend tokens under ~/.follow-github and allowing scheduled digest jobs if you enable them. Prefer read-only GitHub permissions, protect the .env file, leave prompts.remoteUrl unset unless you control the source, and use on-demand/stdout delivery if you do not want third-party messaging or background execution.
7. Fetch the chat ID with: ```bash curl -s "https://api.telegram.org/bot<TOKEN>/getUpdates" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['result'][0]['message']['chat']['id'])" 2>/dev/null || echo "No messages found — send a message to your bot first" ``` Save chat ID as `delivery.chatId`.
All data is fetched **live** from GitHub's API and `github.com/trending` — there is no central feed. Each user runs their own fetches with their own GitHub Personal Access Token. ## Detecting Platform
Save as `github.username` in config. ### Step 3: GitHub Personal Access Token (PAT) Tell the user:
**Non-persistent agent + Telegram or Email:** ```bash SKILL_DIR="<absolute path to the follow-github directory>" (crontab -l 2>/dev/null; echo "<cron expression> cd $SKILL_DIR/scripts && node prepare-digest.js 2>/dev/null | node deliver.js 2>/dev/null") | crontab - ``` Note: this pipes raw JSON to delivery — no LLM remix. For full digests, use `/gh` manually or switch to OpenClaw.
The token is saved to `~/.follow-github/.env` — never committed to git, never sent anywhere except GitHub's own API." Create the .env file: ```bash mkdir -p ~/.follow-github cat > ~/.follow-github/.env << 'ENVEOF'
**If Email:** Ask for their email address, guide through Resend signup at https://resend.com, then: 1. Create an account 2. Create an API key in the dashboard 3. Save the key to `.env` as `RESEND_API_KEY` 4. Save the destination email address as `delivery.email`
across skill updates.
```bash
mkdir -p ~/.follow-github/prompts
cp ${CLAUDE_SKILL_DIR}/prompts/<filename>.md ~/.follow-github/prompts/<filename>.md
```7. Fetch the chat ID with: ```bash curl -s "https://api.telegram.org/bot<TOKEN>/getUpdates" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['result'][0]['message']['chat']['id'])" 2>/dev/null || echo "No messages found — send a message to your bot first" ``` Save chat ID as `delivery.chatId`.
- "Show my settings" → Read and display config.json in a friendly format - "Who am I following?" → Tell them to check https://github.com/<their username>?tab=following (we don't cache the following list — it's fetched fresh each digest) - "Show my prompts" → Read and display prompt files After any configuration change, confirm what you changed.
Detected: suspicious.env_credential_access