hcom-agent-messaging Audit report.

Warnings

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• The installation method uses `curl | sh`, which is a common but potentially risky pattern if the remote script is compromised. No checksum verification is mentioned.
• The skill does not explicitly address security boundaries for agent communication (e.g., trust between agents, handling sensitive data).
• Quality score needs review
• Permission surface needs review: shell or command execution, filesystem or document access
• Dependency/runtime risk: command execution surface, external package install surface
• Permission surface: shell or command execution, filesystem or document access

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.