GitHub Cred

Analyze GitHub user contribution quality. Evaluates owned repos, external contributions, output quality, and social influence. Triggers on "github cred", "an...

Security Scan

An instruction-only skill that defines a subjective GitHub scoring rubric but provides no concrete data‑access instructions or credential requirements, leaving broad discretion about how data is collected.

Purpose & Capability

The stated purpose (analyzing GitHub contribution quality) matches the rubric and output format. However, the skill does not declare any GitHub API credential (GITHUB_TOKEN) or required tooling; while not strictly required, realistic collection of merged PR counts, merge rates, and cross-repo metrics usually needs API access or substantial scraping. The absence of declared credentials is notable but not definitive evidence of misbehavior.

Instruction Scope

SKILL.md is a scoring specification and output template but contains no concrete runtime instructions about where or how to fetch data (GitHub API vs. web scraping), what endpoints to call, or limits on what to collect. That vagueness grants the agent wide discretion to make network requests or gather extra context (potentially beyond what's needed), and it doesn't constrain reading of other data sources. The rubric references metrics (merged PRs, code ratio, merge rate) without defining computation methods or data scopes.

Install Mechanism

There is no install spec and no code files in the package (instruction-only), which is lower risk: nothing is written to disk by the bundle itself. README suggests cloning the author's GitHub repo as an install option, but the published skill contains no install script or downloaded artifacts.

Credentials

The skill requires no environment variables or credentials. That is minimal and reasonable in principle, but inconsistent with the scope of data collection it claims: GitHub API usage (to get PR merge info, commit sizes, follower counts at scale) typically needs a token to avoid rate limits. Because no credential is requested, the agent may either (a) perform unauthenticated, possibly brittle scraping, (b) repeatedly prompt for a token at runtime, or (c) attempt other network activity. No unrelated secrets are requested.

Persistence & Privilege

always is false and the skill does not request persistent system-level privileges or to modify other skills. It does not claim or appear to write system configuration or require elevated access.

What to consider before installing

This skill is an instruction-only scoring rubric with no code and no requested credentials, but it's also vague about how it will retrieve GitHub data. Before installing or using it: 1) Ask the author how the agent will access GitHub (API vs scraping) and whether it will request a GITHUB_TOKEN; prefer a workflow that uses a personal token with minimal scopes if needed. 2) Understand that the rubric is subjective and that the agent's implementation may collect more GitHub data than you expect (PR diffs, commit metadata, repo lists). 3) Test the skill on non-sensitive or public accounts first. 4) If you are uncomfortable with an agent making arbitrary network requests, decline installation or require the skill to explicitly document API calls and required env vars.

Analyze GitHub user contribution quality.

Triggers

• github cred <username>
• analyze <username>'s github

---

Four-Tier Scoring System

Tier 0 — Owned High-Star Repos (30%)

Metric	Score
Own ≥10k⭐ repo	+30
Own ≥5k⭐ repo	+20
Own ≥1k⭐ repo	+10

Cap: 30. Creator > Contributor

Tier 1 — External Contributions (30%)

Metric	Score
Merged PR in ≥100k⭐ repo	+4/PR
Merged PR in ≥10k⭐ repo	+2/PR
Merged PR in ≥1k⭐ repo	+1/PR
Non-trivial (>20 lines)	×1.5

Cap: 30

Tier 2 — Output Quality (20%)

Metric	Score
Merge rate ≥70%	+10
Merge rate ≥50%	+7
Code ratio ≥80%	+5
Diversity ≥10 repos	+5

Cap: 20

Tier 3 — Social Influence (20%)

Metric	Score
≥5k followers	+20
≥2k followers	+15
≥1k followers	+12
≥500 followers	+8
≥200 followers	+5
≥100 followers	+3
<100 followers	+1

---

Grades

Grade	Score	Description
S	95+	Legend — top project creator + core contributor + influencer
A+	85-94	Master — high-star project owner OR top project contributor
A	70-84	Senior — active developer with real contributions
B	50-69	Active — steady contributor
C	30-49	Beginner — some contributions
D	<30	Newbie

---

Output Format

📊 GitHub Cred: @username

🏆 XX/100 (Grade)

▸ Tier 0 Owned Repos (XX/30)
  👑 repo1 ⭐XXk

▸ Tier 1 External Contributions (XX/30)
  🔨 org/repo ⭐XXk × N PRs

▸ Tier 2 Output Quality (XX/20)
  📈 Merge rate XX% | Code ratio XX%

▸ Tier 3 Social Influence (XX/20)
  👥 X,XXX followers

---

Two Paths to A+

• Creator path — Build one 10k+ stars project
• Contributor path — Deep contributions to multiple top projects (100k+ stars)

Mixed is strongest.