360 Secure SkillHub
360 安全技能中心

github repo due diligence lite

通过 Node 脚本对公开 GitHub 仓库发起一次未认证 API 查询，提取 stars、距上次推送天数、许可证和归档标记，按启发式生成健康状态及 adopt/pin+monitor/avoid 建议；仅读元数据，不克隆仓库或检查代码。

nenadzivotic
nenadzivotic
热度 15.99
最近更新 2026-10-17 23:29:19
分类：开发依赖：代码执行 / 第三方 API应用场景：报告撰写 / 研究 / 推荐

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add nenadzivotic/github-repo-due-diligence-lite
Metadata
name
github-repo-due-diligence-lite
description
Quick health check on a public GitHub repo before depending on it — stars, days since last push, license, archived flag, and a health heuristic. Single unauthenticated API call. Use when the user asks whether a GitHub repo is maintained, trustworthy, or safe to adopt.

GitHub Repo Due Diligence (Lite)

Network access (declared)

One GET to api.github.com/repos/<owner>/<repo> — public, unauthenticated (60 req/hr shared limit). No other hosts. No data is sent; the only request is a read of public repo metadata.

Boundaries

  • Metadata only — no repo cloning, no code access.
  • "Stale"/"quiet" is a heuristic on pushed_at; private activity is invisible.
  • Unauthenticated rate limit is low — do not loop over many repos; for batch checks suggest the full version or a token.

1. Run

Requires Node 18+, zero dependencies.

node <skill-dir>/scripts/dd.mjs owner/repo
node <skill-dir>/scripts/dd.mjs https://github.com/owner/repo

JSON on stdout; exit 1 on fetch failure, 2 on bad argument.

2. Read the report

  • stars, lastPushDaysAgo, license (SPDX id or null), archived, health.
  • Flag: archived: true, lastPushDaysAgo > 365, license: null, very low stars for a claimed-popular project.

3. Report

<owner>/<repo>: <health>
stars X · last push Y days ago · license <spdx|none> · archived <yes/no>
<one-line recommendation: adopt / pin+monitor / avoid>

Lite vs full

The full github-repo-due-diligence adds forks, open-issue count, default branch, and primary language, with the same single-request budget.