Open Source Analysis

Analyze an open source GitHub repository and generate a structured report. Trigger whenever the user provides a GitHub repository URL to analyze, or explicit...

This skill appears to do what it says: analyze public GitHub repositories and generate a formatted report. Two things to consider before installing/using it: (1) provenance — the skill's source/homepage is unknown; that reduces trust because you can't verify the publisher or audit a code bundle (this skill is instruction-only but still published by an unknown owner). (2) token handling — SKILL.md will look for GITHUB_TOKEN and, if present, add an Authorization header to API calls to avoid rate limits. The registry metadata currently omits that env var, which is a bookkeeping mismatch but important to you: only provide a GitHub token if you trust the skill and follow the principle of least privilege. If you do provide a token, prefer a token with minimal scopes (avoid granting write scopes; for public-repo reads no special scopes are required), or authenticate via the gh CLI rather than exposing a long-lived personal token. Finally, because the skill has no code files and warns not to execute repo content, the immediate technical risk is low — but verify the publisher or ask them to correct the registry metadata (declare GITHUB_TOKEN) before granting credentials or using it with sensitive accounts.

Type: OpenClaw Skill Name: open-source-analysis Version: 1.0.2 The skill is designed to analyze GitHub repositories and generate structured reports. It includes explicit security instructions in SKILL.md directing the agent to treat external repository content as untrusted data and to avoid executing any embedded commands, which serves as a defense against prompt injection from target repositories. The use of GITHUB_TOKEN is appropriately scoped for GitHub API access to retrieve project metadata.