Skill audit report

constraint-driven-development Audit report.

Establishes a project's quality bar as a written contract and stops agents quietly lowering it. Interviews the user on which dimensions matter, supplies sane default thresholds when they have no number in mind, records everything in CONSTRAINTS.md, and watches the diff for a weakened bar — new @ts-ignore or eslint-disable suppressions, skipped or deleted tests, assertions stripped out, unimplemented stubs, thresholds edited down. Use when no quality bar is written down, when the user says "set up constraints" or "define our standards", when an agent keeps silencing checks or skipping tests to get to green, when you need a coverage or performance threshold and don't know what number to pick, or when an agent writes more code than anyone will read.

BLOCKED · BLOCKNeeds reviewGenerated Nov 4, 2026Heuristic metadata audit
81
Audit
70
Trust
92
Quality
72
Security
88
Maintain
92
Install

OpenAgentSkill Trust Score

70
Manual review

OpenAgentSkill Trust Score

The Trust Score helps an agent decide whether a skill is safe enough to shortlist before installation.

GitHub adoption

PASS

100

91K GitHub stars

Stars/forks activity

PASS

100

91K stars, 9.8K forks; issue activity unavailable in current metadata

Recent maintenance

PASS

88

2mo since push

License clarity

PASS

86

MIT

README/SKILL.md completeness

PASS

86

Metadata includes enough usage and workflow context

Dependency/runtime risk

WARN

44

command execution surface, credential or environment access

Install availability

PASS

92

npx skills add addyosmani/agent-skills --skill constraint-driven-development

Install command safety

PASS

92

standard package or runtime install path

Permission surface

FAIL

36

secrets or environment access, shell or command execution

Repository evidence

PASS

86

https://github.com/addyosmani/agent-skills/tree/main/skills/constraint-driven-development

Review status

INFO

66

AI review data available

Agent Proven outcomes

INFO

54

No agent outcome data yet

Checks

Install and adoption review

8 Passed · 11 Needs review

Install path

92

PASS

npx skills add addyosmani/agent-skills --skill constraint-driven-development

Repository

88

PASS

https://github.com/addyosmani/agent-skills/tree/main/skills/constraint-driven-development

License

86

PASS

MIT

Maintenance

88

PASS

2mo since push

AI review

55

CHECK

The submitted SKILL.md excerpt is truncated mid-sentence during the interview questions, so the full instructions for Step 2 defaults and remaining process steps are not visible in this review payload.

README/SKILL.md completeness

86

PASS

Usable description available

Dependency risk

44

FIX

command execution surface, credential or environment access

Install command safety

92

PASS

standard package or runtime install path

Permission surface

36

FIX

secrets or environment access, shell or command execution

Stars/forks activity

100

PASS

91K stars, 9.8K forks; issue activity unavailable in current metadata

Adoption

88

PASS

91K GitHub stars

Warnings

  • Dependency or permission surface needs review
  • Permission surface may require sandboxing
  • The submitted SKILL.md excerpt is truncated mid-sentence during the interview questions, so the full instructions for Step 2 defaults and remaining process steps are not visible in this review payload.
  • No explicit security guidance is present in the excerpt about handling untrusted project files or avoiding accidental execution of malicious scripts when running the test suite or linters.
  • The floor-guard reference implementation is truncated at the import statement, making it impossible to fully verify redaction, exit-code handling, and diff-scope logic from the submitted files.
  • Permission surface needs review: secrets or environment access, shell or command execution
  • Dependency/runtime risk: command execution surface, credential or environment access
  • Permission surface: secrets or environment access, shell or command execution

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.

Compare nearby options

Related skills to audit next