user-activity — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited user-activity (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Find the repositories an account owns, then retrieve a user's profile, their contributions (commits, PRs, issues, reviews), and star growth per repository.
username, or the owner whose repositories you wantread:user scope, since most of these tools use the GraphQL APIgithub_search_user, github_get_user_activities and github_get_repo_stars_since run as long-running tasks. github_get_user_activities and github_get_repo_stars_since report progress while they work, github_search_user returns in one step and reports none, and github_list_repos is a plain read.
github_list_repos when you do not already know the namegithub_search_user to confirm the user exists and get contextgithub_get_user_activities, optionally filtered by org, repo or date rangegithub_get_repo_stars_since when the question is about stars in a time windowgithub_list_repos| Parameter | Type | Default | Description |
|---|---|---|---|
owner | str | "" | User or organisation. Omit for the caller's own |
sort | str | updated | One of updated, pushed, created, full_name |
per_page | int | 50 | Results per page, 1 to 100 |
page | int | 1 | Page number |
Returns {"count": int, "has_more": bool, "repos": [...]}, each entry carrying name, owner, description, default_branch, private, fork, archived, pushed_at and html_url. count is the page returned, not everything the owner has, and has_more says whether to ask for the next one.
You do not say whether the owner is a person or an organisation, because the tool reads the account type and picks the endpoint itself. That matters: GitHub's organisation endpoint returns 404 for a person, and its user endpoint accepts an organisation but returns only its public repositories.
Omitting owner is the only way to see private repositories you own. Passing your own username instead reads the public listing and quietly leaves them out. An organisation's private and internal repositories do appear, for a token entitled to see them.
An owner that is neither a user nor an organisation fails with a not-found error naming it.
github_search_user| Parameter | Type | Description |
|---|---|---|
username | str | GitHub username to look up |
Returns UserSearchResult: login, name, email, company, location, bio, url, avatar_url, created_at, updated_at, followers, following, public_repos, recent_repos, organizations.
recent_repos is the 10 most recently updated public repositories, not the user's pinned ones. Public repositories only.
github_get_user_activities| Parameter | Type | Default | Description |
|---|---|---|---|
username | str | - | GitHub username |
org | str | "" | Keep only contributions in repos owned by this org or user |
repo | str | "" | Keep only contributions in repos with this name |
since | str | "" | Start date, YYYY-MM-DD or full ISO 8601 |
until | str | "" | End date, YYYY-MM-DD or full ISO 8601 |
max_results | int | 50 | Cap applied to each section separately |
Returns UserActivityResult: username, date_range, total_contributions, commits, pull_requests, issues, reviews, repo_stars.
| Section | Fields per entry |
|---|---|
commits | repo, owner, commit_count, url, date |
pull_requests | repo, owner, number, title, state, url, created, merged |
issues | repo, owner, number, title, state, url, created |
reviews | repo, owner, pr_number, pr_title, pr_url, review_state, review_url, date |
repo_stars | repo, owner, url, description, star_count |
review_state is APPROVED, CHANGES_REQUESTED or COMMENTED. The date on a commit or review entry is when the contribution occurred, whereas created on a pull request or issue is when that item was opened.
Four things about this tool are easy to get wrong:
max_results=50 can return up to 250 entriescommits, pull_requests, issues, reviews and repo_stars, reporting the account-wide totals for the period, so it will exceed the length of the returned lists whenever org, repo or max_results trims them. Do not present it as a count of the listed items. Its repo_stars entry is the current total of stars across the user's public repos, up to the 100 the query reads, and not stars gained in the periodsince/until range longer than that. Split a longer question into per-year callsYYYY-MM-DD or full ISO 8601 such as 2024-01-01T00:00:00Zsince gains T00:00:00Z, until gains T23:59:59Zmax_resultsrepo_starsgithub_get_repo_stars_since| Parameter | Type | Default | Description |
|---|---|---|---|
username | str | - | GitHub username |
since | str | 30 days ago | Start date, YYYY-MM-DD or ISO 8601 |
top_n | int | 5 | Number of repos to return |
max_repos | int | 20 | Maximum repos to inspect |
Returns RepoStarsSinceResult: username, the normalised since cutoff, repos sorted by new_stars descending, each with repo, owner, url, description, new_stars and total_stars, and truncated.
truncated is True in either of two cases. The account has more public repos than the listing could read, 500 being the ceiling, or one repo's star history ran past the twelve pages the walk reads, which is roughly seven years. The answer is then built on a subset and may miss a repo that gained stars, or undercount one that did, so say so rather than reporting it as complete.
This is the tool for any question of the form "which repos gained the most stars recently".
github_get_repo_stars_since(username="saidsef", since="2024-04-01", top_n=5)How it picks and counts:
max_repos with the highest total star countnew_stars: 0Cost follows the length of the window rather than the popularity of the repo. One page of history covers 30 weeks, so a 30-day window costs a single request per repo whether that repo has 5 stars or 50,000.
repo_stars in github_get_user_activities is each repo's current cumulative total and ignores since and until, so it never reports stars gained within a window. Use github_get_repo_stars_since whenever the question is about a time window, and github_get_user_activities only for a snapshot of where a user stands today.
github_list_repos rather than guessing a repository name, and omit owner when you want your own private onesgithub_search_user first, since it confirms the user exists and gives context before the heavier callsorg and repo to scope activity to one projectmax_results at 50 to 100 for wide date ranges, remembering the cap is per sectiontotal_contributions as the account-wide figure, not as a count of the entries listedAPPROVED means the user approved that PR, and CHANGES_REQUESTED means they blocked it~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.