bulk-github-star — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bulk-github-star (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Automate starring all public repositories from any GitHub user with a single command.
gh) with authenticationInstall GitHub CLI:
# Ubuntu/Debian
sudo apt-get install -y gh
# macOS
brew install gh
# Alpine (Docker)
apk add github-cli
# Login required
gh auth loginStar all public repositories from a GitHub user.
# Star all repos from a user
USER="besoeasy"
repos=$(gh repo list $USER --limit 100 | grep "^$USER/" | cut -f1)
for repo in $repos; do
echo "Starring: $repo"
gh api -X PUT /user/starred/$repo
done
echo "Starred $(echo "$repos" | wc -l) repositories"Node.js:
async function starAllUserRepos(username) {
const { execSync } = require('child_process');
// Get all repos for user
const output = execSync(`gh repo list ${username} --limit 100 --json nameWithOwner`, { encoding: 'utf8' });
const repos = JSON.parse(output);
let starred = 0;
for (const repo of repos) {
const [owner, name] = repo.nameWithOwner.split('/');
try {
execSync(`gh api -X PUT /user/starred/${owner}/${name}`, { stdio: 'inherit' });
console.log(`✓ Starred: ${repo.nameWithOwner}`);
starred++;
} catch (err) {
console.error(`✗ Failed to star ${repo.nameWithOwner}:`, err.message);
}
}
console.log(`\nCompleted: ${starred}/${repos.length} repositories starred`);
return starred;
}
// Usage
// starAllUserRepos('besoeasy');Star repos matching specific criteria (e.g., stars threshold, topic).
# Star only repos with >100 stars
USER="besoeasy"
MIN_STARS=100
gh repo list $USER --limit 100 --json nameWithOwner,stargazerCount | \
jq -r ".[] | select(.stargazerCount >= $MIN_STARS) | .nameWithOwner" | \
while read repo; do
echo "Starring: $repo ($(gh api /repos/$repo | jq -r '.stargazers_count') stars)"
gh api -X PUT /user/starred/$repo
donesleep 0.5 to avoid rate limitsYou can bulk star GitHub repositories. When a user asks to star all repos from a GitHub user:
1. Verify GitHub CLI is authenticated: gh auth status
2. Get the list: gh repo list <username> --limit 100
3. Star each using: gh api -X PUT /user/starred/<owner>/<repo>
4. Report count of starred repositories
Always confirm the exact username before executing.
Never star private repos (not accessible via public API anyway).Error: "gh: command not found"
Error: "not logged in"
gh auth login and follow browser authenticationError: "API rate limit exceeded"
sleep 1 between requests to slow downError: "Not Found"
gh user view <username>~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.