GitHub Code Analyzer

What to consider before installing: - This skill will clone the repository you give it and send sampled source files and a project structure to a remote API at ark.cn-beijing.volces.com. If the repo contains sensitive code, secrets, or private info, that data will be transmitted off-host. The SKILL.md does not warn about this. - The code contains a hard-coded API key constant. Embedded keys are dangerous and unexpected; ask the publisher why this key is present and insist on supplying credentials via environment variables instead. - The repo URL is interpolated directly into a shell command using child_process.exec, which can be exploited by specially crafted inputs (shell injection). Only pass trusted, well-formed GitHub URLs, or request the author replace exec with a safer method (e.g., execFile or a git library with argument escaping). - There is no install spec or declared dependencies; confirm the runtime environment will have Node and axios, or request a proper package manifest. - If you need this functionality but want to limit risk: run it in an isolated/sandboxed environment, use only public repositories you control, or request source changes (remove hard-coded key, add explicit env var for API key, sanitize inputs, and document data handling and retention). If you cannot verify the publisher or obtain a clean, dependency-declared package that removes the hard-coded key and addresses input sanitization and explicit data-sharing policies, treat this skill as risky and avoid installing it.

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.