Security audit
Security checks for vulnerabilities and agentic risk
This skill is a read-only GitHub repository analysis helper with disclosed use of GitHub search/API access.
Installers should be comfortable with the skill making read-only GitHub lookups and optionally using existing GitHub authentication for higher API limits. Avoid using it for ambiguous project names unless you confirm the intended repository.
The skill’s trigger condition is broad enough to activate on generic requests about analyzing projects, which can cause unintended invocation outside a narrowly defined GitHub-repository-analysis context. This increases the chance of over-collection, confusion about scope, and accidental handling of unrelated user requests or untrusted external content without explicit user intent.
The expected output explicitly requires 'An English analysis report', which encodes a language constraint in natural-language content. Under the policy, forcing a specific language without user opt-in or a clearly documented regional justification is a violation.
This line requires a Chinese report and additionally states 'NO English headings should be present,' which is a strict locale/language constraint. The file does not provide a documented justification for this enforced language policy beyond the test case itself.
The phrase 'The structure should strictly follow the English template' mandates a specific language/template choice in natural-language content. Because no opt-in or explicit justification is present, this matches the language/locale policy violation criteria.
No suspicious patterns detected.
