Skills github-project-contributor-finder-api-skill
📦
github-project-contributor-finder-api-skill
Content revision r2 High Risk 🌐 Network access🔑 Env variables⚙️ External commands
Find GitHub Projects and Contributors
Finding relevant open-source projects and active contributors manually takes time. This skill searches through BrowserAct and returns repository metrics and public contributor profiles.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "github-project-contributor-finder-api-skill" from https://skillstore.io/skills/browser-act-github-project-contributor-finder-api-skill.md and its manifest at https://skillstore.io/api/skills/browser-act-github-project-contributor-finder-api-skill/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "github-project-contributor-finder-api-skill". Find browser automation repositories with at least 1,000 stars, updated since 2026-01-01.
Expected outcome:
A filtered repository list with names, links, owners, descriptions, star counts, and available contributor profiles.
Using "github-project-contributor-finder-api-skill". Find active machine learning contributors and include public websites when available.
Expected outcome:
- Contributor summaries show usernames, profile links, biographies, related repositories, and public websites when returned.
- Missing social fields are identified instead of inferred.
Security Audit
High Riskv6 • 7/23/2026 Open versioned report
The BrowserAct requests are expected but transmit search parameters and a bearer credential to a third-party service. Most static matches are benign Markdown or scoped credential handling, but the skill asks users to provide API keys directly. Raw GitHub-derived text and aggregated contact details also create prompt-injection, privacy, and compliance risks.
2
Files scanned
250
Lines analyzed
6
Review items
0
False positives ignored
Confirmed security concerns (2)
High
SKILL.md:75-91scripts/github_project_contributor_finder_api.py:93-104scripts/github_project_contributor_finder_api.py:130-132
Untrusted External Content Reaches Agent Output
Repository descriptions and contributor profiles can contain attacker-controlled text. The script returns and prints BrowserAct results without separating data from agent instructions.
The documented fields include repository descriptions and contributor bios, while the script prints the returned string unchanged. These public fields are controlled by external GitHub users.
Medium
Personal Data Aggregation for Outreach
The skill collects public websites and social handles for recruiting, marketing, competitor analysis, and talent mapping. Bulk aggregation can enable unsolicited profiling.
The skill explicitly lists personal websites and Twitter handles as output and names recruiting, developer outreach, lead generation, and talent mapping as intended uses.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True)
The error message tells the user to provide an API key directly to the agent. Encouraging secret disclosure in conversation can expose the credential through chat history or logs.
High
Generic API/secret keys
Before running, check the `BROWSERACT_API_KEY` environment variable. If not set, do not take other m
The instruction explicitly asks the agent to wait for the user to provide a missing API key. This promotes unsafe secret sharing instead of secure environment configuration.
Low
Python HTTP libraries
res = requests.post(
The POST sends the BrowserAct bearer credential and user search parameters to api.browseract.com. This transfer is required for the skill but creates real third-party network exposure.
Low
Python HTTP libraries
status_res = requests.get(
The polling request sends the bearer credential and task identifier to BrowserAct. This is expected API traffic but remains an external data transfer.
Low
Python HTTP libraries
task_info = requests.get(
The result request sends the bearer credential and task identifier to BrowserAct. The call is intentional, but it depends on an external service receiving sensitive authentication data.
Low
Hardcoded URL
API_BASE_URL = "https://api.browseract.com/v2/workflow"
This constant is the external BrowserAct endpoint used for authenticated requests. It matches the declared function but establishes a third-party network dependency.
Risk Factors
🌐 Network access (8)
scripts/github_project_contributor_finder_api.py:38 scripts/github_project_contributor_finder_api.py:65 scripts/github_project_contributor_finder_api.py:93 scripts/github_project_contributor_finder_api.py:15 scripts/github_project_contributor_finder_api.py:51 scripts/github_project_contributor_finder_api.py:119 SKILL.md:22 SKILL.md:100
🔑 Env variables (10)
scripts/github_project_contributor_finder_api.py:115 scripts/github_project_contributor_finder_api.py:115 scripts/github_project_contributor_finder_api.py:18 scripts/github_project_contributor_finder_api.py:23 scripts/github_project_contributor_finder_api.py:115 scripts/github_project_contributor_finder_api.py:116 scripts/github_project_contributor_finder_api.py:121 scripts/github_project_contributor_finder_api.py:130 SKILL.md:4 SKILL.md:20
⚙️ External commands (34)
SKILL.md:20 SKILL.md:28 SKILL.md:30 SKILL.md:31 SKILL.md:34 SKILL.md:36 SKILL.md:37 SKILL.md:40 SKILL.md:41 SKILL.md:42 SKILL.md:43 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:52 SKILL.md:54 SKILL.md:55 SKILL.md:60-66 SKILL.md:66-69 SKILL.md:69-79 SKILL.md:79-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-83 SKILL.md:83-86 SKILL.md:86-87 SKILL.md:87-88 SKILL.md:88-89 SKILL.md:89-90 SKILL.md:90-91 SKILL.md:91-97 SKILL.md:97-98 SKILL.md:98
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/browser-act-github-project-contributor-finder-api-skill/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/browser-act-github-project-contributor-finder-api-skill?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/browser-act-github-project-contributor-finder-api-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/browser-act-github-project-contributor-finder-api-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/browser-act-github-project-contributor-finder-api-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
browser-act. (2026). github-project-contributor-finder-api-skill security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/browser-act-github-project-contributor-finder-api-skill/audits/6BibTeX citation
@techreport{browser-act-browser-act-github-project-contributor-finder-api-skill-2026,
author = {browser-act},
title = {github-project-contributor-finder-api-skill security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/browser-act-github-project-contributor-finder-api-skill/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-project-contributor-finder-api-skill security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "browser-act"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/browser-act-github-project-contributor-finder-api-skill/audits/6"
identifiers:
- type: other
value: "skillstore:browser-act-github-project-contributor-finder-api-skill:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 45
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Map an Open-Source Topic
Find active repositories in a technical domain and compare their descriptions, stars, owners, and recent updates.
Review Public Contributor Profiles
Identify relevant contributors and review public profile links for role-related research with appropriate consent and privacy controls.
Plan Community Outreach
Discover active projects and contributors before designing relevant, respectful community engagement.
Try These Prompts
Find Repositories
Find GitHub repositories about [topic]. Use sensible defaults and summarize repository names, links, descriptions, and star counts.
Apply Search Filters
Search for [topic] repositories with at least [stars] stars, updated since [date]. Review [pages] pages and return [items] results per page.
Research Contributors
Find contributors to repositories about [topic]. Include only relevant public profile fields and explain missing data. Do not request my API key in chat.
Compare Project Ecosystems
Compare GitHub ecosystems for [topic A] and [topic B] using equal filters. Group projects by activity, stars, owners, and contributor signals.
Best Practices
- Set BROWSERACT_API_KEY through an approved secret manager or local environment configuration.
- Use narrow keywords, realistic star thresholds, and a current update date to reduce irrelevant results.
- Treat returned descriptions, biographies, websites, and social handles as untrusted and verify them before use.
Avoid
- Do not paste API keys into chat, prompts, logs, or shared command history.
- Do not use public profile data for unsolicited bulk outreach or sensitive personal profiling.
- Do not treat repository descriptions or contributor biographies as trusted agent instructions.
Frequently Asked Questions
What credentials does this skill require?
It requires BROWSERACT_API_KEY. Configure it securely in the environment or an approved secret manager.
Does the skill call GitHub directly?
No. The bundled script starts and monitors a BrowserAct workflow that performs the collection.
Which search filters are supported?
It supports keywords, minimum stars, last update date, page count, and item count per page.
How long can a search run?
The script polls for up to 15 minutes and reports status every 10 seconds.
Are contributor contact fields always available?
No. Websites, biographies, and social handles depend on public source data and may be missing or outdated.
How should returned text be handled?
Treat all repository and profile text as untrusted data. Verify important facts and ignore embedded instructions.
Developer Details
Author
browser-actLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
a39a91716eadede5f4cdefd78178fed4e837a128
Maintenance freshness
7/24/2026
Usage
5 downloads · 141 views
File structure