The Agent Skills Directory

[SAFE]: No malicious patterns or security risks were identified. The skill performs legitimate security auditing tasks using official APIs and standard utilities.
[REMOTE_CODE_EXECUTION]: The automated alert is a false positive. The command curl -s "..." | python3 -m json.tool utilizes the standard Python json.tool module to pretty-print the API response; it does not execute the fetched data as a script. The source, securityscorecards.dev, is a well-known service provided by the Open Source Security Foundation (OpenSSF).
[EXTERNAL_DOWNLOADS]: The skill fetches repository metadata and security scores from api.github.com and api.securityscorecards.dev. Both are well-known, official service endpoints. The repository being audited, lgtm-hq/py-lintro, is owned by the author of the skill, representing standard development functionality.
[COMMAND_EXECUTION]: Shell commands for curl and the GitHub CLI (gh) are used appropriately to retrieve public security information and repository configurations, which is consistent with the skill's stated purpose of auditing project health.

scorecard