GitHunt

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Your location, role, and skill search terms may be sent to githunt.ai to retrieve ranked GitHub profiles.

Why it was flagged

The helper script sends the user’s search parameters to the GitHunt API. This is expected for a developer-search skill, but it means search criteria are shared with an external service.

Skill content

curl -s -N -X POST "$API_URL/rank/users/stream" ... -d "$payload"

Recommendation

Use the skill only for searches you are comfortable sending to the GitHunt service, and review the service’s terms/privacy practices if that matters for your workflow.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The helper script may fail or behave differently if required local tools are unavailable, but no hidden installation or remote code execution is shown.

Why it was flagged

The included helper script depends on local command-line tools such as curl and jq, while the registry requirements list no required binaries. This appears to be an under-declared but purpose-aligned helper dependency.

Skill content

response=$(curl -s -X POST "$API_URL/rank/users" ... --compressed 2>/dev/null) ... jq -r

Recommendation

If using the script rather than the documented curl examples, make sure curl and jq are installed and inspect the script before running it.