Security audit

Lingxi · GitHub Trending Daily Digest

Security checks across malware telemetry and agentic risk

Overview

This skill is a small, disclosed GitHub Trending digest helper that fetches public project data and can save scheduled markdown reports locally.

Before installing, decide whether you want scheduled runs to create files in ~/github-digest and manage cleanup or retention yourself. If you use GITHUB_TOKEN, use the least privilege token needed for public repository metadata and avoid broad account scopes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The skill explicitly documents a scheduled command that saves digest files to a local path under the user's home directory, but it does not clearly warn the user in the usage or scheduling flow that local filesystem writes will occur automatically. This is a real but low-severity transparency and consent issue: unattended scheduled writes can create unexpected files, consume disk space over time, or store sensitive analysis output in predictable locations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.