verify-security Audit report.

Warnings

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• SKILL.md lacks an explicit limitations section, so users may not know that heuristic checks can produce false positives or miss context-dependent vulnerabilities.
• Step 1 lists Cargo.toml for dependency review, but Step 2.2 only covers Python and JavaScript/TypeScript dependency pinning, leaving Rust dependency checks unspecified.
• The report template uses checkbox placeholders that could be misinterpreted by an agent if not replaced correctly with actual findings.
• Low GitHub adoption signal
• Quality score needs review
• Permission surface needs review: secrets or environment access, filesystem or document access
• GitHub adoption: 44 GitHub stars
• Stars/forks activity: 44 stars, 5 forks; issue activity unavailable in current metadata
• Dependency/runtime risk: credential or environment access, network or browser surface
• Permission surface: secrets or environment access, filesystem or document access

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.