constraint-driven-development 审计报告.

警告

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• Financial research output is not financial advice; require human review before any live investment decision
• The submitted SKILL.md excerpt is truncated mid-sentence during the interview questions, so the full instructions for Step 2 defaults and remaining process steps are not visible in this review payload.
• No explicit security guidance is present in the excerpt about handling untrusted project files or avoiding accidental execution of malicious scripts when running the test suite or linters.
• The floor-guard reference implementation is truncated at the import statement, making it impossible to fully verify redaction, exit-code handling, and diff-scope logic from the submitted files.
• Financial research output is not financial advice; require human review before any live investment decision.
• Permission surface needs review: secrets or environment access, shell or command execution
• Dependency/runtime risk: command execution surface, credential or environment access
• Permission surface: secrets or environment access, shell or command execution

方法

本报告综合公开元数据、AI 审查输出、仓库活跃度、安装就绪度、OpenAgentSkill 事件、质量评分、信任检查和 Agent 安全门槛；它不是完整的源代码安全审计。