Github_tracker

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:44 AM UTC
• Version: 1.0.3

Overview

This GitHub team monitor has a legitimate purpose, but it needs review because it uses broad repository access and includes a bundled state file with real private-repository and personnel activity data.

Review before installing. Use only a tightly scoped read-only GitHub token, verify the hard-coded organization and team are intended, remove the bundled sample_state.json, and avoid running the cron job until state and log retention are controlled.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: sample_state.json:2664

Finding

Bundled State File Discloses Private Repository and Personnel Activity Data

Content

View full analysis

Vulnerability Details

File Location: sample_state.json:2664-2717
Additional Evidence: sample_state.json:19-29
Vulnerability Type: Sensitive information exposure through a distributed state artifact
Risk Level: High

Vulnerable Data Snippet

json

"author": {
    "login": "tenkus47",
    "id": 42644738,
    "node_id": "MDQ6VXNlcjQyNjQ0NzM4",
    "avatar_url": "https://avatars.githubusercontent.com/u/42644738?v=4",
    "url": "https://api.github.com/users/tenkus47",
    "html_url": "https://github.com/tenkus47"
},
"parents": [
    {
        "url": "https://api.github.com/repos/OpenPecha/url-shortening/commits/b28ad7092f14d57b54ecf5f7aae4b2b6494a8528",
        "html_url": "https://github.com/OpenPecha/url-shortening/commit/b28ad7092f14d57b54ecf5f7aae4b2b6494a8528",
        "sha": "b28ad7092f14d57b54ecf5f7aae4b2b6494a8528"
    }
],
"repository": {
    "id": 969515297,
    "node_id": "R_kgDOOcmhIQ",
    "name": "url-shortening",
    "full_name": "OpenPecha/url-shortening",
    "private": true,
    "owner": {
        "login": "OpenPecha",
        "id": 82142807
    },
    "html_url": "https://github.com/OpenPecha/url-shortening",
    "description": "Implementation of url shorterning"
}

Other records in the same file include personal email addresses, commit messages, commit hashes, timestamps, API URLs, and account metadata.

Technical Analysis

The package includes a 545 KB state snapshot containing raw GitHub API responses. At least one record explicitly identifies a private repository and associates it with a named contributor and commit history.

Runtime or example data distributed with a Skill should be synthetic and minimized. A monitor only needs aggregated activity data, such as a username and the number of active days. Raw API responses containing repository visibility, commit identifiers, email addresses, messages, and extensive account metada ...[truncated 1595 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove sample_state.json from the distributed package immediately.
2. Purge the artifact from source-control history, release archives, package registries, build caches, and mirrors where feasible.
3. Determine who received the artifact and perform incident review under the organization’s data-exposure process.
4. Replace the file with a small, fully synthetic example containing fictitious usernames, repositories, hashes, dates, and email addresses.
5. Add state.json, sample_state.json, monitor.log, and similar runtime artifacts to .gitignore and packaging exclusion rules.
6. Add automated secret and sensitive-data scanning that rejects examples containing private repository flags, real email addresses, raw API responses, or organization-specific identifiers.
7. Store only the minimum aggregates necessary for monitoring rather than complete API response objects.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/monitor.py:224

Finding

Organization-Wide Repository Scanning and Detailed Persistence Exceed Least Privilege

Content

View full analysis

Vulnerability Details

File Location: scripts/monitor.py:224-322
Related Locations: scripts/monitor.py:22-35, scripts/monitor.py:151-218, scripts/monitor.py:443-448, scripts/monitor.py:484-486
Vulnerability Type: Excessive GitHub authorization scope, collection scope, and local persistence
Risk Level: Medium

Vulnerable Code Snippets

python

def _api_headers():
    token = os.getenv("GITHUB_TOKEN")
    if not token:
        raise RuntimeError(
            "Set GITHUB_TOKEN in your environment (Personal Access Token with repo scope)."
        )
    return {
        "Accept": "application/vnd.github+json",
        "Authorization": f"Bearer {token}",
        "X-GitHub-Api-Version": "2026-03-10",
    }

python

def _iter_org_repos(headers):
    page = 1
    while True:
        data = _get_json_allow_missing(
            f"https://api.github.com/orgs/{ORG}/repos",
            headers,
            {
                "per_page": 100,
                "page": page,
                "type": "all",
                "sort": "pushed",
                "direction": "desc",
            },
        )
        if not data:
            break
        yield from data
        if len(data) < 100:
            break
        page += 1

python

for repo in _iter_org_repos(headers):
    full = repo.get("full_name") or ""
    if "/" not in full:
        continue
    if _repo_pushed_before_window(repo, window_start):
        stale_push_early_exit = True
        break
    owner, name = full.split("/", 1)
    repos_scanned += 1
    branches = list(_iter_repo_branches(headers, owner, name))
    if not branches:
        skipped_repos += 1
        continue
    for br in branches:
        branch_name = br.get("name")
        if not branch_name:
            continue
        branch_requests += 1
        for commit_obj in _paginate_comm
...[truncated 4131 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the classic PAT recommendation with a fine-grained GitHub token.
2. Grant metadata and contents access as read-only and restrict the token to the exact organization and repositories required by the monitor.
3. Exclude private repositories by default. Require an explicit allowlist and documented authorization before monitoring any private repository.
4. Accept a repository allowlist through configuration rather than enumerating every repository returned by "type": "all".
5. Retain only aggregate activity values required by the report, such as active days and total commits. Do not persist repository or branch names unless operationally necessary.
6. Create state and log files with owner-only permissions, such as mode 0600, and use a protected application data directory rather than the current working directory.
7. Add retention and cleanup controls for state and logs.
8. Avoid logging complete team membership and repository names at INFO level; use redacted DEBUG logging only when explicitly enabled.
9. Document the exact GitHub permissions, repository scope, collected fields, retention period, and report audience.
10. Prefer a GitHub App installation token with read-only, repository-scoped permissions for centrally managed deployments.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/monitor.py:11

Finding

Documented Organization Configuration Is Ignored in Favor of a Hard-Coded Target

Content

View full analysis

Vulnerability Details

File Location: scripts/monitor.py:11
Related Location: SKILL.md:6-8
Vulnerability Type: Security-relevant configuration mismatch
Risk Level: Low

Vulnerable Code and Documentation

python

ORG = "OpenPecha"
WINDOW_DAYS = 3
TEAM_SLUG = "openpecha-dev-team"

markdown

3. Set Environment Variables:
   - `GITHUB_TOKEN`: Your Personal Access Token.
   - `GITHUB_ORG`: Your Organization name.

Technical Analysis

The documentation tells operators that GITHUB_ORG controls the organization being monitored, but the implementation never reads that variable. Instead, ORG is always set to OpenPecha. The team slug is also fixed to an OpenPecha-specific value.

Security-sensitive scope must be explicit and enforceable. A configuration option that appears to constrain access but is silently ignored can cause authenticated requests to target an organization the operator did not intend to monitor. It can also cause information from the hard-coded organization to be written into local state, logs, and channel reports.

This is not arbitrary server-side request forgery because the endpoint and organization are fixed. It is a configuration integrity failure that can lead to unintended data access and disclosure.

Attack Path

1. An operator installs the Skill for a different organization.
2. The operator sets GITHUB_ORG according to the documented setup instructions.
3. The script silently ignores that setting and sends authenticated requests for the hard-coded OpenPecha organization and openpecha-dev-team.
4. If the supplied token can access that organization, the script collects its team and repository activity.
5. The resulting OpenPecha data is stored in state.json, recorded in logs, and printed for posting to the configured updates channel.

Impact Assessment

The script cannot access data beyond the supplied token’s GitHub permissions. ...[truncated 383 chars]

Remediation

View remediation

Remediation Suggestions

1. Read the organization from the documented environment variable:

   python

   ORG = os.environ["GITHUB_ORG"]
   

2. Make the team slug configurable as well, for example through GITHUB_TEAM_SLUG.
3. Validate both values against an expected character set and reject missing or empty settings.
4. Display the resolved organization and team before execution and require explicit deployment configuration.
5. If the Skill is intentionally restricted to OpenPecha, remove the misleading GITHUB_ORG instruction and clearly disclose the fixed organization and team.
6. Add tests confirming that configured scope is honored and that the script fails closed when required scope settings are absent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3107)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md

1. Place `monitor.py`, and `SKILL.md` in the skill folder.
2. get the list of member needed for this skill from the `monitor.py`
3. Set Environment Variables:
   - `GITHUB_TOKEN`: Your Personal Access Token.
   - `GITHUB_ORG`: Your Organization name.

## Automation

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/monitor.py (reported line 29)May include surrounding context.

python

1. Place `monitor.py`, and `SKILL.md` in the skill folder.
2. get the list of member needed for this skill from the `monitor.py`
3. Set Environment Variables:
   - `GITHUB_TOKEN`: Your Personal Access Token.
   - `GITHUB_ORG`: Your Organization name.

## Automation

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 13)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 17)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 19)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 32)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 43)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 45)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 46)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 47)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 48)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 49)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 50)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 51)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 52)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 53)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 64)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 66)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 67)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 68)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 69)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 70)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 71)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 72)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sample_state.json (reported line 73)May include surrounding context.

json

def get_team():
    headers = _api_headers()
    logger.info("Fetching team members org=%s team=%s", ORG, TEAM_SLUG)
    url = f"https://api.github.com/orgs/{ORG}/teams/{TEAM_SLUG}/members"
    res = requests.get(url, headers=headers, timeout=_REQUEST_TIMEOUT)
    res.raise_for_status()
    members = [user["login"] for user in res.json()]

Static analysis

No suspicious patterns detected.