GitHub 国内访问加速 skill，使用 githubproxy.cc 代理加速 GitHub 仓库克隆、文件下载、Raw 文件访问等操作。使用场景：(1) 需要 git clone GitHub 仓库时加速，(2) 下载 GitHub Release 文件、Raw 文件、Archive 压缩包时加速，(3) 任何需要访问 GitHub 资源但速度慢的场景
Risky behavior the analysis could not rule out.
scripts/convert_url.py, which SKILL.md tells the agent to run, programmatically rewrites any matching GitHub URL to proxy + / + url with the proxy defaulting to https://githubproxy.cc and a fallback to https://ghfast.top, channeling every converted download through these third-party endpoints.
{proxy}/{url}What the analysis could not settle from the code alone.
Candidates the review stage examined and rejected, kept for transparency.
The helper script hardcodes a second third-party proxy ghfast.top, reachable via a --backup flag, that the target's declared description (which names only githubproxy.cc) does not declare, sending fetched GitHub URLs through an additional non-official host; the behavior is disclosed in SKILL.md as a backup service but is undeclared at the target level and routes release/archive content through a host with no integrity guarantees.
BACKUP_PROXY =
ghfast.top is not concealed: the artifact declares it as its backup proxy in the 代理服务 section and in the 注意事项 fallback rule, and it is reachable only via an explicit --backup flag for the same declared proxy-acceleration operation, so the behavior is declared within the artifact and stays inside the declared core capability's carve-out.
SKILL.md instructs the agent to route git clones and file downloads (raw files, releases, archives, gists) through the third-party proxy https://githubproxy.cc/, so all fetched code and files pass through a proxy operator of unknown trust who can modify content before it is built or executed.
git clone https://githubproxy.cc/https://github.com/username/repo.git
Routing git clones through githubproxy.cc is exactly the skill's declared core capability ('使用 githubproxy.cc 代理加速 GitHub 仓库克隆、文件下载、Raw 文件访问等操作'), stated openly in the frontmatter description, so the harm carve-out applies and the behavior is declared, not concealed. The speculative risk that the proxy operator might tamper with content is inherent to any mirror the skill exists to wrap, not an undeclared behavior of the artifact.
SKILL.md instructs the agent to fetch GitHub raw files through the third-party proxy githubproxy.cc, placing an unaffiliated intermediary in a position to substitute downloaded code or files, though this matches the skill's declared acceleration purpose.
wget https://githubproxy.cc/https://raw.githubusercontent.com/username/repo/main/file.txt
Proxying raw-file fetches through githubproxy.cc is the declared core capability ('Raw 文件访问' is named verbatim in the description) and is disclosed with an exact example in the skill body, so the harm carve-out applies and nothing is undeclared or concealed.
SKILL.md instructs routing GitHub repository clones and raw/release/archive downloads through the third-party proxy githubproxy.cc (backup ghfast.top), so all fetched code passes through an untrusted intermediary that could substitute content.
| `https://github.com/username/repo.git` | `https://githubproxy.cc/https://github.com/username/repo.git` |
The conversion table is the skill's declared core capability: the description explicitly claims acceleration for clones, Release files, Raw files and Archive packages via githubproxy.cc, and even the parenthetical backup host ghfast.top is openly declared in the skill body, so neither a harm beyond the carve-out nor concealment exists.
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scannedcontext:unanalyzable_binary binary content is only byte-scannedcontext:submodule_present submodules are not fetchedcontext:unanalyzable_binary binary content is only byte-scannedexternal_plugin_source plugin 'openviking-memory' source is not localcontext:manifest_unparseable yaml: YAML aliases are not permittedcontext:manifest_unparseable yaml: while scanning a simple keycontext:manifest_unparseable yaml: while parsing a flow nodecontext:manifest_unparseable yaml: while parsing a flow nodecontext:manifest_unparseable yaml: while parsing a flow nodecontext:manifest_unparseable yaml: while parsing a flow nodecontext:manifest_unparseable yaml: while parsing a flow nodecontext:manifest_unparseable yaml: while parsing a flow nodecontext:manifest_unparseable yaml: while parsing a flow nodecontext:manifest_unparseable yaml: while parsing a flow nodecontext:manifest_unparseable yaml: while parsing a flow nodecontext:manifest_unparseable yaml: while parsing a flow nodecontext:manifest_unparseable yaml: while parsing a flow nodecontext:manifest_unparseable yaml: while parsing a flow nodecontext:manifest_unparseable yaml: while parsing a flow nodecontext:manifest_unparseable yaml: while parsing a block mappingcontext:manifest_unparseable yaml: while parsing a flow node