Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a local web app delivery guide, but it also tells an agent to read stored GitHub credentials and use them for repository creation and pushes.
Install only if you are comfortable with an agent receiving guidance that includes reading local GitHub credential storage and pushing or creating repositories. Before use, remove or ignore the GitHub credential-extraction section and require explicit user-approved authentication for any publishing workflow.
The documentation explicitly instructs reading and parsing ~/.git-credentials to extract a GitHub token and use it for API calls. This is credential harvesting from local secret storage and enables unauthorized access to GitHub resources well beyond what a local webapp-delivery skill should need.
The skill’s scope expands from local webapp delivery into GitHub repository creation, credential handling, and remote push automation. That broadening materially increases authority and data-exfiltration risk because it encourages operations against external services and local auth state that are unnecessary for the core task.
The skill describes extracting stored GitHub credentials from the local machine and using them to authenticate and push. This directly enables secret misuse and unauthorized remote actions, creating both credential-compromise and repository-integrity risks.
Referencing ~/.git-credentials in operational guidance is dangerous because it points the agent toward a local credential store containing reusable secrets. In this context, the file is not merely mentioned academically; it is presented as a source of a GitHub token to enable authenticated remote actions.
## 推送到 GitHub（本机实测路径）
`gh` CLI 装了但**未登录**（`gh auth status` 报 not logged into any GitHub hosts），
不过本机 `~/.git-credentials` 里存着 `github.com` 的 classic token（40 字符，
scope `gist, repo, workflow`），身份即你的 GitHub 用户名），照样能建仓库和推送。
先解析出来验证，再动手：
The code snippet actively opens ~/.git-credentials, regex-extracts username and token, and prepares them for API use. This is explicit secret extraction logic and would allow the agent to access or act on behalf of the user’s GitHub account.
先解析出来验证，再动手：
m = re.search(r'https?://([^:]+):([^@]+)@github\.com', open(os.path.expanduser('~/.git-credentials')).read())
user, tok = m.group(1), m.group(2)
# 用 token 调 API 验证身份 + 权限 + 是否已有同名仓库，再决定建不建
The invocation description is overly broad and can cause the skill to activate for loosely related tasks, increasing the chance that high-risk instructions inside it are applied outside their intended context. In this file, that risk is amplified because the skill also contains credential-access and remote-push guidance.
The instruction '提交信息用中文、多段' imposes a specific language requirement in natural language. There is no indication that the user can choose their preferred language or that this is a justified locale-specific constraint, which conflicts with language-choice expectations.