giasip-dispatch Audit report.

Warnings

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• Codex write mode with sandbox=full can modify project files; ensure explicit user confirmation and git repo check before invoking.
• The skill sources .env files from ~/.config/ai-keys/, which executes shell code from those files; advise verifying file ownership/permissions (0600) and that only trusted keys are present.
• Manual BASE_DIR setup is fragile; if the skill is moved/installed as a plugin, the hardcoded path may break. Suggest deriving the script directory dynamically.
• Low GitHub adoption signal
• Quality score needs review
• Permission surface needs review: secrets or environment access, shell or command execution
• GitHub adoption: 12 GitHub stars
• Stars/forks activity: 12 stars, 0 forks; issue activity unavailable in current metadata
• Dependency/runtime risk: command execution surface, credential or environment access
• Permission surface: secrets or environment access, shell or command execution

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.