Is detect-github-url safe to install?

SaferSkills independently audited detect-github-url (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/detect-github-url/SKILL.md · 1 file

skills/detect-github-url/SKILL.md1.5 KB · Markdown

name: detect-github-url

description: >

Detects when the user pastes or mentions a GitHub URL that may contain Claude

skills or plugins. Triggers on messages containing github.com URLs, especially

when user says things like "here's a repo", "check out this repo", "load this",

"use these skills", "I found these skills", or simply pastes a github.com link.

Make sure to use this skill whenever a GitHub URL appears in the user's message

that might contain Claude Code skills or plugins.

user-invocable: false

Detect GitHub Skill Repository

The user has shared a GitHub URL. Recognize it and offer to browse its skills.

What to Do

Identify the GitHub URL from the user's message.

Respond naturally — acknowledge the link and explain you can browse

available skills.

Offer to browse:

"I can check this repo for skills and show you what's available. Want me to take a look?"

When the user confirms, run /skills-load <url>. This shows a numbered

catalog — the user picks which skills to install as a plugin.

If the URL doesn't look like a skills repo, still offer:

"This might not contain Claude skills — want me to check anyway?"

Key Points

Be conversational, not robotic
The catalog-first approach means the user picks what they need — no bulk loading
Selected skills get packaged as a .plugin file and presented with a

"Save plugin" button for one-click installation into the / menu

Skills are also injected into the conversation for immediate use

detect-github-url— agent skill

Is detect-github-url safe to install?

Detect GitHub Skill Repository

What to Do

Key Points

Audit the pieces. Scan the whole. Decide.