github-deep-research
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses a structured research workflow to analyze public GitHub repositories. All external interactions are conducted through standard tools: a local Python script for the GitHub API and platform-provided web search/fetch tools.
- [COMMAND_EXECUTION]: The skill executes a local Python script (
scripts/github_api.py) to interface with the GitHub API. This script is part of the skill package and uses standard libraries (requestsorurllib) to fetch repository metadata, READMEs, and activity logs. The execution is scoped to the skill's own scripts and parameters are limited to repository owners and names. - [EXTERNAL_DOWNLOADS]: The skill interacts with the official GitHub API (
api.github.com) to retrieve repository data. These are standard API calls for a research tool and do not involve downloading or executing arbitrary remote code. - [DATA_EXFILTRATION]: No patterns of sensitive data exfiltration were found. The tool is designed to read public repository data and generate research reports. It does not access local credentials, environment files, or other sensitive user data.
Audit Metadata