Security audit
Security checks across malware telemetry and agentic risk
This GitHub-publishing skill is mostly coherent, but it deserves review because it handles GitHub write tokens, publishes local files publicly, has a privacy-scan gap, and writes activity into memory.
Install only if you are comfortable giving the workflow GitHub write access and publishing the selected directory publicly. Prefer a fine-grained, minimal-scope, short-lived token or GitHub CLI auth, avoid pasting tokens into chat or shell history, manually review the files to publish, run a privacy scan that includes SKILL.md and scripts, and disable or avoid persistent memory logging for repository details unless you explicitly want it.
| 私有仓改公开 | `private` topic 残留 | 改完 visibility 立即重设 topics | | 描述拼接中英混排 | 仓库主页"中英缝合感" | 全部用纯中文一句话 | | commit message 中文逗号 | zsh 显示"nothing to commit" 误报 | 实际成功,看 git log 确认 | | 凭据来源失效 | Keychain PAT 读不到、gh CLI 未登录 | 必问用户贴 PAT,只用一次立即清空 | ## 客观挑刺清单（必做项）
发布完一个项目后，必须： 1. `unset GH_TOKEN` —— 凭据立即从环境清空 2. 临时文件 `rm -rf /tmp/xxx-review` —— 不留痕 3. 写 memory：今天推了几个仓、commit hash、踩了什么坑 4. 主动挑刺 + 报告，让用户决定是否继续
发布完一个项目后，必须： 1. `unset GH_TOKEN` —— 凭据立即从环境清空 2. 临时文件 `rm -rf /tmp/xxx-review` —— 不留痕 3. 写 memory：今天推了几个仓、commit hash、踩了什么坑 4. 主动挑刺 + 报告，让用户决定是否继续
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.
