repo-scout

Discover, evaluate, and rank GitHub repositories in any ecosystem or domain. Produces a structured ranking document with star counts, languages, issue health...

What to consider before installing and running repo-scout: - The SKILL.md asks you to use an authenticated GitHub CLI or provide a GH_TOKEN; the skill manifest did not declare this. Treat that as a manifest bug and exercise caution. - Only provide a GitHub token with the minimal scopes needed (read-only repo access or fine-grained token scoped to public repositories). Do NOT supply a full org-admin or write-scoped token. - Prefer authenticating gh locally (gh auth login) rather than pasting a token into a UI or environment that you don't control. If you must export GH_TOKEN, do so in a temporary shell and revoke the token after use. - Review the generated {workspace}/ecosystem-top{N}.md before using downstream workflows. The skill will run gh and fetch repo files; verify outputs for sensitive info before sharing. - Ask the skill author/registry maintainer to update the manifest to declare required binaries (gh) and required env vars (GH_TOKEN) so the platform can surface the requirement transparently. - Because this is instruction-only (no install code), the immediate code risk is low, but the undeclared credential requirement is the main concern. If you need higher assurance, request the author to provide an explicit list of required gh scopes and to confirm the skill will not transmit the token elsewhere.

Type: OpenClaw Skill Name: repo-scout Version: 1.0.0 The 'repo-scout' skill is a legitimate tool designed to discover and rank GitHub repositories based on contribution friendliness. It uses the standard GitHub CLI (`gh`) for data collection and produces a structured markdown report in the workspace, with no evidence of malicious execution, data exfiltration, or prompt injection (SKILL.md).