repo-scan

80 / 100 · Low risk

Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.

By KerberosClaw/kc_ai_skills (GitHub) · coding · 79 stars · scanned at commit dbd37fb

Use when the user wants to evaluate a GitHub repository before installing, running, forking, or depending on it. Takes a GitHub repo URL, cleans tracking params, shallow-clones to /tmp, inspects dependency/supply-chain risk, static vulnerability patterns, issue-reported security problems, maintainer health, and produces a risk summary. NOT for reviewing the user's own PR diff or for running untrusted code.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. Expected for a coding skill.

Found in 7 places.

repo-scan/SKILL.md, line 49git --version
repo-scan/SKILL.md, line 67git clone --depth 50 {repo_url} /tmp/repo-scan-{repo_name}
repo-scan/SKILL.md, line 114- `exec()`、`execSync()`、`spawn()` 使用未過濾的外部輸入

Show 4 more

repo-scan/SKILL.md, line 115- `os.system()`、`subprocess.call()` 拼接字串
repo-scan/SKILL.md, line 186gh issue list -R {owner}/{repo} --state all --limit 200
repo-scan/SKILL.md, line 194gh issue view {issue_number} -R {owner}/{repo}
repo-scan/SKILL.md, line 214gh repo view {owner}/{repo} --json stargazerCount,forkCount,createdAt,updatedAt,licenseInfo,description

Downloads and installs other software

The author does not mention this.

Found in 1 place.

repo-scan/SKILL.md, line 170- [ ] 是否有 `curl | bash` 或 `wget | sh` 模式

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'repo-scan' ] || [ -L ~/.agents/skills/'repo-scan' ]; then echo 'A skill folder named repo-scan already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/KerberosClaw/kc_ai_skills' "$d" && git -C "$d" checkout --quiet 'dbd37fbe2121356fe25b69c70cbe5fc8b8870415' -- 'repo-scan' && mkdir -p ~/.agents/skills && cp -R "$d"/'repo-scan' ~/.agents/skills/'repo-scan' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'repo-scan' ~/.claude/skills/'repo-scan' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for KerberosClaw/kc_ai_skills shows the score of its lowest-scoring skill.

SkillTrust badge for KerberosClaw/kc_ai_skills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/KerberosClaw/kc_ai_skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/KerberosClaw/kc_ai_skills/)

Score history

Date	Version	Score
2026-11-07	`dbd37fb`	80