GitHub AI Trends

• Outcome: Pass
• Latest audit: May 28, 2026, 12:10 PM
• Version:
  1.1.0

Overview

This skill fetches public GitHub AI repository trends and formats them as a chat leaderboard, with only optional GitHub token use for rate limits.

Safe to install for live GitHub AI trend lookups. If using a GitHub token, prefer an environment variable or secret manager, use a least-privilege token, and avoid pasting tokens into chat, command examples, logs, or shell history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The description includes broad trigger phrases such as requests for AI trends, GitHub trending, or AI leaderboard, which can match common user intents and cause over-invocation. An overly broad invocation surface can make the agent run code unexpectedly, increasing the chance of unnecessary network requests or credential use in contexts where a simple text answer would have been safer.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill tells users they can provide a GitHub token via a CLI flag or environment variable but does not include any warning about sensitive credential handling. This can lead to accidental token exposure through shell history, logs, process listings, or careless sharing of command output.

VirusTotal

63/63 vendors flagged this skill as clean.