GitHub Trending Scraper

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:44 PM UTC
• Version:
  1.0.0

Overview

This skill does what it claims: it fetches public GitHub Trending pages and returns JSON, with an optional user-chosen output file.

Install only if you are comfortable with the skill making HTTPS requests to GitHub. If using --output, write to a temporary or workspace file you intend to replace, and avoid pointing it at important files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script accepts a user-controlled --output path and writes scraped data directly to that location. In an agent or automation context, this exceeds the stated read/scrape-only behavior and can be abused to overwrite arbitrary files accessible to the running user, creating integrity and scope-violation risks even though the written content is only JSON.

VirusTotal

66/66 vendors flagged this skill as clean.