Skill

scan-github-stars

skill:vinta/awesome-python#scan-github-stars

Scan the maintainer's GitHub stars for README.md addition candidates; incremental by default, `full` rejudges stars judged before.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:45 UTC at 9beb5d6

findings

high

highest severity

threat classes

131

files scanned

1,066/1,068

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.claude/skills/scan-github-stars:.claude/skills/scan-github-stars/SKILL.md:30:EXEC
suspicious: unverified finding skill:.claude/skills/scan-github-stars:.claude/skills/preview-verdicts/template.html:97:MANIP
suspicious: unverified finding skill:.claude/skills/scan-github-stars:README.md:542:SUPPLY
suspicious: unverified finding skill:.claude/skills/scan-github-stars:README.md:603:SUPPLY
suspicious: unverified finding skill:.claude/skills/scan-github-stars:website/templates/_entry_rows.html:88:MANIP
suspicious: unverified finding skill:.claude/skills/scan-github-stars:website/templates/base.html:47:EXFIL
suspicious: unverified finding skill:.claude/skills/scan-github-stars:website/templates/redirect.html:6:MANIP

Security findings 7

Code execution

highContextual riskmedium confidence

The scan-github-stars SKILL.md steps 3-5 direct the agent to invoke the sibling audit-the-list skill and run preview-verdicts, and audit-the-list/SKILL.md lies outside consumed content, so at runtime the agent applies instructions whose content cannot be reviewed.

.claude/skills/scan-github-stars/SKILL.md:30

follow `audit-the-list` step 5 for the README change

vector:instruction

Counter-argument considered

The strongest case against the finding is that the invocations are openly declared workflow steps (D5-D7) with inline constraints, but the quote means exactly what the claim says: the skill directs the agent to follow audit-the-list step 5 for a README change with one commit per entry, and the served statements confirm both delegated files sit outside consumed content, so the runtime instructions remain unreviewable and no declaration or carve-out neutralizes that. The spurious PY-CLAIM-CONTRADICTION leads about category intros do not touch this claim.

Data exfiltration

highUnverifiedmedium confidence

Undeclared telemetry: the site template embeds Google Analytics (property G-0LMLYE0HER), sending every visitor's page-view data to www.googletagmanager.com, a capability the scan-github-stars skill's declared purpose does not declare.

website/templates/base.html:47

src=

vector:code

Manipulation

mediumUnverifiedlow confidence

The preview-verdicts template interpolates third-party-controlled strings (entry name, URL, reason, source) into HTML via innerHTML without escaping, so a crafted star description or entry string could silently insert script into the maintainer's verdict-review page and falsify the verdicts they approve; this integrity risk is not declared anywhere.

.claude/skills/preview-verdicts/template.html:97

<td class=

vector:code

Supply chain

mediumUnverifiedmedium confidence

The openbb entry in the README this skill curates links to github.com/openbq-org/OpenBB, a one-character look-alike of the official OpenBB organization name, undeclared by the skill and capable of misdirecting readers of the list to an impersonating repository.

README.md:542

openbq-org/OpenBB

vector:instruction

Supply chain

mediumUnverifiedlow confidence

The README's mesa entry links to github.com/mesa/mesa rather than the canonical projectmesa/mesa repository of the Mesa agent-based modeling library, a look-alike URL undeclared by the skill that can misdirect readers to a different repository.

README.md:603

[mesa](https://github.com/mesa/mesa)

vector:instruction

Manipulation

mediumUnverifiedlow confidence

Website templates render README-derived entry descriptions, paying sponsors' text, and build-supplied guide/JSON-LD content through Jinja's | safe filter, disabling HTML autoescaping so crafted sponsor or README content could inject script into the published site; this output-integrity surface is not declared.

website/templates/_entry_rows.html:88

<div class=

vector:code

Manipulation

mediumUnverifiedlow confidence

The redirect template interpolates target_url unescaped into a script location assignment and meta refresh, silently sending visitors to whichever URL the build supplies without a visible destination check; undeclared by the skill's stated purpose.

website/templates/redirect.html:6

<script>location=

vector:code

Open questions 18

What the analysis could not settle from the code alone.

Does pydantic/httpx2 exist as a legitimate fork of encode/httpx, or is the README entry steering pip installs to a typosquat of the widely used httpx package?

Supply chain

Several detector leads quote text (a jwt.decode 'hard-code the algorithms' claim, a 'Fernet or PyNacl' cryptography directive, and a pyglet 'no external dependencies' link) that does not appear in any shown unit span of this artifact; does that text exist elsewhere in the artifact, or are the leads stale or fabricated?

PY-CLAIM-CONTRADICTION/PY-CLAIM-RESIDUE leads quote claim text ('pyglet is a windowing and multimedia library [with no external dependencies]...', 'hard-code the `algorithms` you pass to `jwt.decode()`') that appears in none of the cited units; the cited units contain only citation hyperlinks to library documentation sites, and their 'chsh', '.env', and '.pre-commit-config.yaml' excerpts are descriptive or advisory (e.g. 'don't make it your login shell with `chsh`'), not capabilities or instruct⟦… 139 more chars …⟧

Manipulation

PY-CLAIM-CONTRADICTION leads (e.g. DET:5beae8e3bac2c412, class EXFIL, high) attribute the claim 'pyglet is a windowing and multimedia library [with no external dependencies]' to units such as SRC:0fc519b9d43fec65, SRC:0c10913e84dc7cf7 and SRC:4b434ef226468c88, but those units contain no pyglet claim at all; the only cited unit containing the claim is SRC:29171dcb293ab9d4 (game-development.md), where the links to panda3d/renpy/pyglet docs are ordinary documentation citations and no contradiction ⟦… 59 more chars …⟧

Detector leads DET:13f42a3c78445414, DET:14add7e256982e98, DET:15d2493e29e40816 and DET:173fc6151aa604d8 (classes CRED/PERSIST) cite website/tests/test_fetch_github_stars.py, website/build.py and website/tests/test_build.py with units=[]; none of these files or paths are referenced by any owed unit in this batch and their content is not shown, so the hits (test file read/write calls, cache_file.read_text, load_downloads) could not be verified or refuted here.

Detector leads DET:223a1115f04a259f through DET:fbdba7fecb27ce30 attribute EXFIL severity=high to these units, but the claimed text ('pyglet is a windowing and multimedia library [with no external dependencies]...') does not appear in any cited unit; the cited content contains only outbound documentation hyperlinks (e.g., to facebook.github.io, spacy.io, docs.celeryq.dev) in reader-facing library guidance, which is not exfiltration. The referenced claim apparently lives in a category file not sh⟦… 151 more chars …⟧

The PY-CLAIM-CONTRADICTION detector leads cite a 'pyglet ... no external dependencies' claim and a jwt 'algorithms' claim allegedly inside the category intro files, but no such text appears anywhere in the shown unit spans; these leads could not be verified against the visible evidence and may reference content outside the shown units or be detector artifacts.

Residue R8 / contradiction C115 attributes an instructed host-config write of scan_github_stars.py to SKILL.md line 13, but the shown text only instructs running the skill's own script via `uv run python`; no host-config write is visible in this batch, so the basis for this residue item cannot be adjudicated as necessary, unexplained, or concealed.

Persistence

index.html states the site is 'Maintained by @vinta and @JinyangWang27'; whether this co-maintainer attribution is accurate for this repository or is an unauthorized change to the awesome-python brand cannot be settled from the evidence shown.

Impersonation

The PY-CLAIM-CONTRADICTION/PY-CLAIM-RESIDUE detector leads classify outbound documentation hyperlinks (pandas.pydata.org, docs.pola.rs, clickhouse-driver.readthedocs.io, etc.) in these static category-intro markdown sections as EXFIL network capability. Verified against the cited content: these are inert citation links in reader-facing documentation prose with no fetch instruction, no script, and no executable code, so the EXFIL leads are unconfirmed and not filed as findings; no artifact file r⟦… 43 more chars …⟧

Data exfiltration

All PY-CLAIM-CONTRADICTION leads quote a 'pyglet is a windowing and multimedia library [with no external dependencies]' claim (and one CRED lead quotes a jwt.decode 'algorithms' claim) that appears in none of the cited units; the cited content is library documentation whose URLs are ordinary hyperlinks to official docs, not network sinks, so the alleged EXFIL/CRED contradictions could not be verified and no behavior chain results from them.

[file request .claude/skills/audit-the-list/SKILL.md] Does the audit-the-list skill, invoked per scan-github-stars step 3, stay within judging proposed entries (Evidence and Verdicts steps, verdicts reported back) or does it steer additional behavior such as README writes, commits, or network access?

Agent hijacking

[file request .claude/skills/preview-verdicts/SKILL.md] Does the preview-verdicts skill, invoked per scan-github-stars step 4, stay within presenting verdicts for maintainer review, or does it steer additional behavior or bypass the maintainer go-ahead gate?

Agent hijacking

[file request .claude/skills/preview-verdicts/SKILL.md] How does this skill embed rows into template.html's __DATA__ and __KEY__ placeholders, and is the embedded data JSON-escaped so third-party entry strings cannot inject HTML/JS into the review page?

Manipulation

[file request .claude/skills/audit-the-list/SKILL.md] What capabilities does audit-the-list exercise when invoked from scan-github-stars step 3 (network fetches, README edits, commits), and does its design honor the scoping text 'Evidence and Verdicts steps only; no preview page, no README changes, no commits'?

Code execution

[file request .claude/skills/audit-the-list/SKILL.md] Step 3 of scan-github-stars invokes the audit-the-list skill and step 5 defers README changes to its step 5; does that skill contain any instructions to hide actions from the user, send data off-host, or make changes beyond judging candidates and recording verdicts?

Agent hijacking

[file request .claude/skills/preview-verdicts/SKILL.md] SKILL.md step 4 directs the agent to run preview-verdicts over all groups; does that skill's content instruct command execution, network fetches, or writes outside the repository?

Code execution

[file request .claude/skills/audit-the-list/SKILL.md] SKILL.md step 5 directs the agent to follow audit-the-list step 5 for the README change; does that referenced instruction from the sibling skill include commands, network fetches, or writes beyond README edits and git commits?

Code execution

Refuted findings 5

Candidates the review stage examined and rejected, kept for transparency.

Credential access

criticalRefutedlow confidence

Undeclared residue (R5, env copy): the test helper copies the entire process environment into git commit subprocesses, so every variable the test process holds reaches child git processes; undeclared by the skill's stated purpose and plainly test plumbing.

website/tests/test_build.py:253

env = {**os.environ,

Why it was refuted

Strongest case for the finding: os.environ is copied verbatim into child processes, undeclared by the description. Strongest case against: the explicit dict only adds two fake commit dates and reproduces the environment inheritance any subprocess gets anyway (the adjacent `git add` call on the next line inherits os.environ implicitly with no env= argument), the sink is a local `git commit` in the test's own tmp_path repo, and no value leaves the host — plainly benign test plumbing, so the harm gate fails.

Supply chain

highRefutedlow confidence

The README lists a package named httpx2 at pydantic/httpx2 claiming it is a Pydantic-maintained fork of httpx, a look-alike package name with an unverifiable authority claim that the declared star-scanning curation purpose does not establish.

README.md:394

[httpx2](https://github.com/pydantic/httpx2)

Why it was refuted

The cited URL targets the genuine pydantic GitHub organization — the same org this README uses for the canonical pydantic entry — so it cannot route readers to an impersonator's code, and publishing vetted README entries is the artifact's declared curation capability with this exact entry present as declared content; the look-alike-name theory does not survive.

Data exfiltration

highRefutedmedium confidence

The undeclared pepy cross-check script sends package-name requests carrying an X-API-Key header to api.pepy.tech, a network destination the declared GitHub-stars-scanning purpose does not declare (adjudicated unexplained: it queries the third-party stats service it wraps and nothing is hidden).

website/fetch_pypi_downloads_via_pepy.py:30

PEPY_URL =

Why it was refuted

api.pepy.tech is the third-party stats service the script openly wraps: its docstring states the purpose and rate limits, and the only request sends the queried package name to that service's own v2 endpoint carrying its own API key — the wrapped-service carve-out plus fully open in-artifact documentation kill the exfiltration reading.

Credential access

highRefutedmedium confidence

The undeclared pepy cross-check helper reads PEPY_TECH_API_KEY from the environment and falls back to parsing the repo-root .env file for that key, a credential-access capability the declared GitHub-stars-scanning purpose does not declare (adjudicated unexplained: fully documented in the script, nothing concealed).

website/fetch_pypi_downloads_via_pepy.py:35

key = os.environ.get(

Why it was refuted

PEPY_TECH_API_KEY is the env API key for the wrapped pepy.tech service; it is read from the environment with a .env fallback restricted to that exact key name and used solely as the X-API-Key header to api.pepy.tech, and both sources are documented in the docstring — the wrapped-service-key carve-out applies and nothing is concealed.

Credential access

highRefutedlow confidence

Undeclared residue (R4, env '*'): the test fixture enumerates every environment variable name in the process to strip GIT_* keys for git test isolation, an env capability the scan-github-stars declared purpose does not cover, though nothing is hidden and no values leave the host.

website/tests/test_build.py:225

for key in [k for k in os.environ if k.startswith(

Why it was refuted

Strongest case for the finding: env '*' is technically outside the declared description and unlogged. Strongest case against: the fixture reads only variable NAMES and deletes GIT_* keys in-process for git test isolation — no values are captured, nothing leaves the host, and no sink or agent instruction exists, so this is inert, fully visible test plumbing and the harm gate fails (keys-only enumeration is broad permission with no misuse; the residue finding itself concedes 'nothing is hidden and no values leave the host').

Coverage gaps 5

Parts of the artifact the static analysis could not fully examine.

ledger_finding_without_valid_finding run 1: declared-vs-actual.13 SRC:9d5d226609d3d534

ledger_finding_without_valid_finding run 1: declared-vs-actual.13 SRC:e0d211d181075d7f

invalid_judge_finding declared-vs-actual.13

request_unanswered request.0: declared-vs-actual.0/req-preview-gen: finding: no valid finding cites the answer's evidence

invalid_judge_finding request.0