Github Trending Daily

The name/description (push GitHub Trending to DingTalk) matches the code and SKILL.md: the script fetches trending pages, formats Markdown, and posts to a DingTalk webhook. However, the skill includes a specific hard-coded webhook URL inside the code rather than requiring the user to supply their own, which is unexpected for a push-notification integration.

SKILL.md simply instructs how to run the script and add a cron job and states '钉钉 Webhook: 已配置' without telling the user to configure their own webhook or pointing how to change it. The runtime instructions and code will send messages to the embedded webhook by default; the skill does not read or transmit any other local files or secrets, but the silent use of a third-party webhook is scope creep relative to the documentation.

There is no install spec; this is an instruction-only skill with an included Python script. Nothing is downloaded or written at install time, which reduces install-time risk.

The skill requests no environment variables, but embeds a full DingTalk webhook URL (including an access_token-like value) in plaintext. A well-scoped push skill would require the operator to provide their own webhook (env var or config file). Embedding someone else's webhook is disproportionate and could cause unexpected outbound posting or leak data to the webhook owner.

The skill does not request 'always: true', does not modify other skills or system settings, and runs only when invoked or via user-installed cron. There is no evidence of privilege escalation or permanent platform-wide changes.