GitHub Trending is a useful discovery surface. It is not a trust score. Rapid adoption can increase the blast radius of a vulnerable workflow before maintainers and downstream teams have time to understand it.
The decision behind the headline
The 2026 Gemini CLI advisory shows why the boundary matters. The OSV record for GHSA-wpqr-6v78-jr5g documents unsafe workspace trust and a tool-allowlisting bypass in headless environments. Pillar Security’s analysis explains how untrusted issue text, broad agent permissions, persisted Git credentials, and workflow chaining could have produced a repository supply-chain compromise.
What the evidence supports
Before adopting a fast-rising project, check:
- what exact job it solves and whether a smaller dependency can solve it;
- release cadence, maintainer response, security policy, and unresolved critical issues;
- pinned versions, lockfiles, provenance, dependency review, and update path;
- default permissions for actions, agents, shell commands, network, and credentials;
- a disposable sandbox trial before the tool touches real repositories or secrets.
The important question is not whether the project is popular. It is whether the dependency can fail without silently gaining more authority than its job requires.
Social verdict
A Reddit bug-bounty discussion focused on the same Gemini CLI chain and linked the underlying research. Another Reddit thread about scanning MCP servers lists tool poisoning, secret exposure, dependency risk, and unexpected version changes as separate review surfaces. These community posts are not substitutes for an advisory, but they show which failure modes practitioners are actively watching.
Current verdict
Treat trending as an inbox. Promote a repository only after ownership, permissions, provenance, dependencies, and rollback have been inspected. For agent tools, assume every readable file, inherited token, and allowed command can become part of the attack path.