gh-profile
Fail
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes multiple references to and code snippets for
https://visitor-badge.laobi.icu/badge, which has been flagged as a malicious or blacklisted URL by security scanners. - [DATA_EXFILTRATION]: The instructions encourage users to integrate visitor tracking badges. While common for GitHub profiles, these services function by harvesting the IP addresses and geographic metadata of profile visitors, which constitutes a form of passive data collection/exfiltration.
- [REMOTE_CODE_EXECUTION]: The skill provides templates for GitHub Actions workflows that pull code from various third-party repositories (e.g.,
Platane/snk,gautamkrishnar/blog-post-workflow). While these are popular in the community, the skill occasionally references unpinned versions (e.g.,@latest,@master), which is a security anti-pattern as it allows the external source to change the executed code at any time without review.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata