GitHubTrustAuditor - Defensive GitHub trust & repository security audit

项目说明

GitHub Trust Auditor

Defensi account & repository security auditing — in the browser, CLI, or GitHub Actions.

![Live Demo]()
![GitHub stars]()
![GitHub forks]()
![Latest release]()

Maintained by SamAlpha1 · Follow on X

> Paste a GitHub username or profile URL. GitHub Trust Auditor scans accessible public repositories with static analysis and returns a 0–100 o score, repository-by-repository scores, risk signals, contribution context, and file/line e — without executing target code.

فارسی: یوزرنیم یا لینک GitHub را وارد کن؛ ابزار ریپوهای عمومی قابل‌دسترسی را بدون اجرای کد اسکن می‌کند و امتیاز کلی، ریسک‌ها و شواهد فایل/خط را نمایش می‌دهد.

Live web app

Accepted inputs:

Shareable scan links:

The web interface supports English + فارسی, result sharing, X posting, direct scan links, README badges, per-repository scores, e lines, and GitHub contribution context.

Use it in GitHub Actions

GitHub Trust Auditor can also run directly inside another repository's workflow.

Full Action documentation: GITHUB_ACTION.md
Copy-ready example: examples/github-trust-audit.yml

The reusable Action was smoke-tested against the public SamAlpha1 account and that JSON and HTML reports are produced.

Why use it?

Score model

| Area | Weight |
|---|---:|
| Security | 60 |
| Repository hygiene | 20 |
| History & reputation | 12 |
| Contribution activity | 8 |
| Total | 100 |

bands:

Generic wallet/network capability is treated as context, not proof of malicious behavior. Strong alarms require stronger correlated behavior, such as sensitive data combined with an explicit exfiltration destination or dangerous executable install behavior.

What it checks

| Area | Examples |
|---|---|
| Seed / pri / password handling | prompts, literals, .env access, sensiti flows |
| Data exfiltration | secrets correlated with HTTP/webhook/
| Clipboard / wallet replacement | clipboard reads/writes and wallet-address replacement patterns |
| Wallet approvals | unlimited approvals, permit/allowance patterns |
| Transactions | signing/sending behavior and undocumented transaction capability |
| Install scripts | preinstall, postinstall, download-and-execute chains |
| Obfuscation | eval, exec, Base64 decode+execute, encoded PowerShell |
| Secret exposure | committed keys/tokens/mnemonic-shaped and sensiti |
| GitHub Actions | broad permissions, secrets used in network-capable shell steps |
| Repository hygiene | README, license, SECURITY, CI, completeness |
| Reputation context | account age, stars/forks, original repos, recent activity |
| Green squares | contributions, active days and streaks — capped at 8% |

GitHub green squares

When public contribution data is a, the report includes contribution total, active days, longest streak, current streak and calendar cells.

Contribution activity is capped at 8% of the account score and ne a security warning. Uniform-looking activity is not treated as proof of wrongdoing.

CLI

Export reports:

Safety model

GitHub Trust Auditor does not execute target repository code. It does not install target dependencies, run target scripts, connect a wallet, sign target transactions, or request seed phrases/private wallet keys from the scanned account.

A clean result is not proof that a person is trustworthy, and a red result is not proof that a person is a scammer. Results describe observable technical signals in scanned co. Static analysis can produce false positives and false negatives.

Private third-party repositories cannot be inspected without legitimate access.

Community & contributing

Launch & updates

Project launch post on X:

Releases:

License

MIT — see LICENSE.

Maintainer

GitHub: SamAlpha1
X:

If GitHub Trust Auditor is useful to you, Star the repository, share your result, and follow SamAlpha1 on GitHub and X.

项目信息

开发语言：Python

Star 数：3

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Defensive GitHub trust & repository security auditor for static analysis, wallet security, secret exposure and suspicious code signals.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。