dual-axis-skill-reviewer Audit report.

Warnings

• Permission surface may require sandboxing
• Financial research output is not financial advice; require human review before any live investment decision
• No critical security issues found. The script executes tests via subprocess, which could run arbitrary code if the target project's tests are malicious, but this is expected behavior and the user controls the project root.
• The SKILL.md is thorough, but the LLM review step could be more explicit about how to obtain the JSON (e.g., via Claude Code or external LLM) and how to handle errors in the LLM output.
• Financial research output is not financial advice; require human review before any live investment decision.
• Quality score needs review
• Permission surface needs review: shell or command execution, filesystem or document access
• Permission surface: shell or command execution, filesystem or document access

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.