GitHub仓库深度解读器

GitHub 仓库深度技术解读 — 输入任意开源项目 URL，一键生成架构分析、代码洞察、知识卡片和多平台发布报告。

Security Scan

The skill's stated purpose (deep analysis of GitHub repos) matches its instructions, but the SKILL.md relies on external CLIs/skills (gh, summarize, Agent-Reach, python/card-renderer) and implicit credentials that are not declared, creating incoherence and hidden dependency/credential risks.

Purpose & Capability

The skill's name and description match the workflow (repo metadata, README summarization, community search, card rendering). However, the skill declares no required binaries or environment variables while the instructions explicitly call gh CLI, a summarize CLI, python scripts, and other skills — a mismatch that suggests missing dependency/credential declarations.

Instruction Scope

Instructions stay within the stated purpose (collect repo metadata, read README, analyze dependency files, gather community feedback, render cards). They instruct writing README content to /tmp and running API calls. They also call Agent-Reach to crawl social platforms — which is consistent with 'community feedback' but expands network collection beyond GitHub (Twitter/X, Reddit, HackerNews).

Install Mechanism

There is no install spec (instruction-only), which is low risk in general, but the runtime depends on external CLIs and scripts (gh, summarize, python render script) that must be present on the host. The skill does not declare these as required binaries or explain how they are provided, making runtime assumptions that may be surprising or unsafe.

Credentials

requires.env is empty, but the gh CLI and some social APIs typically require authentication tokens (e.g., GH_TOKEN/GITHUB_TOKEN, API keys for Twitter/X) that are not declared. Agent-Reach may also need credentials or third-party scraping access. The lack of declared credentials is a proportionality/visibility concern: installing this skill may cause implicit use of credentials already available to the agent without explicit disclosure.

Persistence & Privilege

The skill is not always-enabled and does not request elevated persistent privileges. It doesn't attempt to modify other skills or system-wide configs in the provided instructions.

Scan Findings in Context

[no_code_files_to_scan] expected: Regex scanner found no code files because this is an instruction-only skill; the main security surface is the SKILL.md instructions (which reference external CLIs and other skills).

What to consider before installing

This skill appears to do what it promises (automated repo analysis), but it assumes tools and credentials that are not declared. Before installing, verify: (1) which dependent skills (github, summarize, Agent-Reach, card-renderer) you trust and whether they require API keys or tokens; (2) whether the agent environment will expose GH_TOKEN/GITHUB_TOKEN or other social API keys — the skill will use gh and Agent-Reach network requests which could access those credentials implicitly; (3) that the host has gh, the summarize CLI, Python and the card-renderer available (or that you are comfortable installing them). If you plan to analyze private repos or allow network crawling, explicitly confirm which credentials will be used and inspect the dependent skills' behavior to avoid unintended data exposure.

GitHub Repo Deep Dive

输入任意 GitHub 仓库 URL，自动完成技术架构分析、核心代码解读、文档摘要，并生成可视化知识卡片和多平台发布内容。

适用场景

• 开源项目技术选型调研
• 竞品技术架构分析
• 新人上手项目快速了解
• 技术博客/公众号素材积累
• 工程团队技术雷达构建

依赖技能

技能	作用
github	获取仓库元数据、文件结构、Stars/PRs 数据
summarize	深度摘要 README 和关键文档
Agent-Reach	搜索项目评价、使用场景、社区讨论
card-renderer	生成小红书风格架构解读知识卡片

工作流程

Step 1 → github
  │  gh repo view owner/repo
  │  gh api repos/owner/repo --jq '.description, .language, .stargazers_count'
  │  → 输出：仓库基本信息、语言、Star数、描述
  │
  ▼
Step 2 → github
  │  gh api repos/owner/repo/contents --jq '.[].name'
  │  → 输出：根目录文件列表
  │
  ▼
Step 3 → summarize
  │  summarize "https://github.com/owner/repo" --model google/gemini-3-flash-preview
  │  → 输出：README 深度摘要、技术亮点总结
  │
  ▼
Step 4 → Agent-Reach
  │  搜索项目在 Twitter、Reddit、GitHub Discussions 的评价
  │  → 输出：社区反馈、用户场景、使用痛点
  │
  ▼
Step 5 → github
  │  分析 package.json / requirements.txt / Cargo.toml 等依赖文件
  │  → 输出：技术栈判定、关键依赖列表
  │
  ▼
Step 6 → card-renderer
  │  生成「架构解读」风格知识卡片（Mac Pro 极客风）
  │  → 输出：封面图 + 详情页图
  │
  ▼
Step 7 → github
  │  生成 Markdown 格式完整分析报告
  │  → 输出：结构化技术报告文档

快速开始

分析单个仓库

输入：https://github.com/tensorflow/tensorflow

系统自动完成：

1. 获取仓库基本信息（语言、Star、描述）
2. 读取 README 并生成深度摘要
3. 分析核心文件结构和技术栈
4. 搜索社区讨论和用户评价
5. 生成架构知识卡片
6. 输出完整 Markdown 分析报告

批量分析多个仓库（对比场景）

输入：[vercel/next.js, remix-run/react-router, astro/astro]

生成并排对比报告，包含：

• 技术栈对比表
• Stars / Fork 对比
• 架构风格对比
• 适用场景总结

输出示例

知识卡片内容结构

封面

• 项目名称 + 一句话定位
• Star 数 / 语言 / 架构风格标签
• 技术雷达（核心依赖）

详情页

• 项目简介
• 核心架构模式
• 技术栈详解
• 优缺点分析
• 社区反馈摘要
• 适用场景建议

命令行使用

# 方式一：直接分析（由 Agent 执行）
gh repo view owner/repo --json name,description,language,stargazerCount

# 方式二：获取文件树
gh api repos/owner/repo/contents --jq 'map({name, type})'

# 方式三：获取 README
gh api repos/owner/repo/readme --jq '.content' | base64 -d

注意事项

• 部分私有仓库内容可能无法获取
• 卡片渲染建议使用 Mac Pro 极客风风格，契合技术内容调性
• 分析完成后建议保存报告到飞书 Wiki 或 Obsidian 知识库