GitHub Repo Trust Scanner — OSS Risk Report

Surface-level due diligence for public GitHub repositories before you install, depend on, recommend, or show them to a client.

This actor is for developers, AI/vibe-coding builders, agencies, security consultants, and researchers who need a quick structured answer to: "does this repo look maintained and safe enough to inspect further?"

It is not a full code audit or vulnerability scanner. It gathers public GitHub evidence and returns a conservative trust/risk summary.

What it checks

For each repository, the actor returns:

• Trust score and plain-English verdict
• Recent activity: last push/update age
• Archived/disabled/fork status
• Stars, forks, watchers, open issues
• License detected by GitHub
• SECURITY.md in common locations
• Latest GitHub release age
• Common dependency/build files such as package.json, requirements.txt, go.mod, Cargo.toml, Dockerfile, Dependabot config, and CI workflow
• README install signals, including risky curl | sh / wget | bash style patterns
• Top-contributor concentration snapshot
• Evidence and limitations for manual review

Example input

{
  "repos": [
    "https://github.com/psf/requests",
    "python/cpython"
  ],
  "maxRepos": 25
}

Example output fields

{
  "full_name": "psf/requests",
  "trust_score": 82,
  "verdict": "low visible risk",
  "risk_flags": ["no SECURITY.md found in common locations"],
  "positive_signals": ["recent activity: last push 12 days ago", "license detected: Apache-2.0"],
  "repo_metadata": {"stars": 53000, "forks": 9400, "pushed_at": "..."},
  "evidence": {"dependency_files_found": ["requirements.txt", "pyproject.toml"]}
}

Pricing

Charged per valid repository scanned: $0.03 / repo.

Limitations

• Surface-level public metadata check only.
• Not a code audit, malware scan, exploit scan, or legal opinion.
• Uses unauthenticated public GitHub APIs and raw files, so very large batches can hit GitHub rate limits.
• Risk scoring is heuristic. Treat it as a triage signal, not a final verdict.

Good uses

• Screen open-source repos before adding them to a project.
• Compare a shortlist of libraries for maintenance/trust signals.
• Add OSS due-diligence rows to an agency/client report.
• Build a watchlist of repos that need deeper manual review.