github-trending
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/fetch.pyutilizes the__import__()function to load theremodule dynamically. While functionally correct for loading the standard library, this pattern is a common technique for obscuring dependencies from static analysis tools.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository metadata (descriptions and topics) from the GitHub API and incorporates it into Markdown files stored in the agent's vault, which may later be processed by the agent.\n - Ingestion points:
scripts/fetch.pyfetches repository details from the public GitHub API and the trending page scraper.\n - Boundary markers: Absent; external strings are interpolated directly into Markdown templates without protective delimiters or instructions to ignore embedded commands.\n
- Capability inventory: The skill has permissions to write to the file system (vault).\n
- Sanitization: Absent; external content from repository descriptions is not sanitized or escaped before being written to the output file.
Audit Metadata