Thanks for the feedback. This is how the auth scopes are defined for the GH API. Anything less wouldn't allow it to pull the repo info when using http://icodedis.tool.cards/#/submit
This GH app, for instance, received similar feedback and its author removed the offending scopes without losing functionality: https://news.ycombinator.com/item?id=11261953