Findings & checks · 1 flagged
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · README.md
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Trace & refs
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
repiq
AI agents pick libraries by guessing. repiq gives them real data instead.
You: "Add an HTTP client library"
Agent: repiq npm:axios npm:ky npm:got → compares downloads, maintenance, dependencies → recommends with evidencerepiq fetches stars, downloads, commit activity, and more from GitHub, npm, PyPI, crates.io, and Go Modules. It returns Markdown tables by default (or JSON with --json) -- no opinions, no scores. The agent reasons. You decide.
Install
go install github.com/yutakobayashidev/repiq/cmd/repiq@latestOr with Nix:
nix run github:yutakobayashidev/repiqAgent Skills
repiq is available as an Agent Skill for AI coding agents (Claude Code, Cursor, Windsurf, etc.).
npx skills add github:yutakobayashidev/repiqWith agent-skills-nix:
sources.repiq = {
github = { owner = "yutakobayashidev"; repo = "repiq"; };
};
skills.enable = [ "repiq" ];
targets.claude.enable = true;Quick Start
repiq github:facebook/react## GitHub
| Target | Stars | Forks | Open Issues | Contributors | Releases | Last Commit (days) | Commits (30d) | Issues Closed (30d) |
|--------|-------|-------|-------------|--------------|----------|--------------------|---------------|---------------------|
| github:facebook/react | 234000 | 47000 | 1000 | 1700 | 220 | 0 | 80 | 150 |Use Cases
- Library comparison -- compare downloads, maintenance activity, and dependency count across candidates in one command
- Maintenance check --
last_commit_days,commits_30d, andissues_closed_30dreveal whether a project is abandoned, stable, or actively developed - Download trends --
weekly_downloadsvsmonthly_downloads(npm, PyPI):weekly * 4 / monthly > 1means accelerating adoption - License compliance -- SPDX license identifiers from GitHub, npm, PyPI, crates.io, and Go for quick enterprise checks
- Supply chain risk --
dependencies_countshows how much a package pulls in;reverse_dependencies(crates.io) shows ecosystem penetration - Cross-ecosystem evaluation -- compare equivalent packages across languages (e.g. zod vs pydantic vs serde) using GitHub as the common axis
Examples
Compare web frameworks
repiq github:expressjs/express github:fastify/fastify github:honojs/hono npm:express npm:fastify npm:honoCheck if a repo is still maintained
repiq github:some-org/some-libEvaluate ORM options
repiq github:prisma/prisma github:drizzle-team/drizzle-orm github:typeorm/typeorm npm:prisma npm:drizzle-orm npm:typeormLicense check for enterprise adoption
repiq github:facebook/react github:preactjs/preact github:sveltejs/svelteCross-ecosystem comparison
repiq npm:zod pypi:pydantic crates:serdeSupported Providers
| Provider | Format | Example |
|---|---|---|
| GitHub | github:<owner>/<repo> | github:facebook/react |
| npm | npm:<package> | npm:react, npm:@types/node |
| PyPI | pypi:<package> | pypi:requests |
| crates.io | crates:<crate> | crates:serde |
| Go Modules | go:<module> | go:golang.org/x/text |
Want to add a new provider? See Adding a Provider and Contributing Guide.
Metrics
<details> <summary><strong>GitHub</strong> (9 metrics)</summary>
| Metric | Description |
|---|---|
stars | Star count |
forks | Fork count |
open_issues | Open issue count (includes PRs) |
contributors | Number of contributors |
release_count | Total releases |
last_commit_days | Days since last commit |
commits_30d | Commits in the last 30 days |
issues_closed_30d | Issues closed in the last 30 days |
license | SPDX license identifier (e.g. MIT, Apache-2.0) |
</details>
<details> <summary><strong>npm</strong> (6 metrics)</summary>
| Metric | Description |
|---|---|
weekly_downloads | Downloads in the last 7 days |
monthly_downloads | Downloads in the last 30 days |
latest_version | Latest published version |
last_publish_days | Days since last publish |
dependencies_count | Number of runtime dependencies |
license | License identifier (e.g. MIT, ISC) |
</details>
<details> <summary><strong>PyPI</strong> (7 metrics)</summary>
| Metric | Description |
|---|---|
weekly_downloads | Downloads in the last 7 days |
monthly_downloads | Downloads in the last 30 days |
latest_version | Latest published version |
last_publish_days | Days since last publish |
dependencies_count | Number of runtime dependencies |
license | License identifier |
requires_python | Python version requirement (e.g. >=3.9) |
</details>
<details> <summary><strong>crates.io</strong> (7 metrics)</summary>
| Metric | Description |
|---|---|
downloads | Total all-time downloads |
recent_downloads | Downloads in the last 90 days |
latest_version | Latest stable version |
last_publish_days | Days since last publish |
dependencies_count | Number of normal dependencies |
license | SPDX license identifier |
reverse_dependencies | Number of crates that depend on this one |
</details>
<details> <summary><strong>Go Modules</strong> (4 metrics)</summary>
| Metric | Description |
|---|---|
latest_version | Latest version tag |
last_publish_days | Days since last publish |
dependencies_count | Number of direct dependencies |
license | License identifier (via deps.dev) |
Go does not provide public download count APIs. Use GitHub metrics for popularity signals.
</details>
Output Formats
| Flag | Format | Description |
|---|---|---|
| _(none)_ | Markdown | Tables grouped by provider (default) |
--json | JSON | Single JSON array |
--ndjson | NDJSON | One JSON object per line |
Authentication
GitHub provider only. Token is resolved automatically:
gh auth token(GitHub CLI)GITHUB_TOKENenvironment variable- Unauthenticated (60 req/hour)
Other providers require no authentication.
Development
# Enter dev environment (requires Nix)
nix develop
# Run tests
go test ./...
# Lint
golangci-lint run ./...