chem-db-mof Audit report.

Warnings

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• The script excerpt is truncated, so full code review is not possible; however, no obvious security red flags are present in the visible portion.
• The skill does not mention checksum verification for downloaded files (e.g., geometric_properties.csv, tarball), which could be a supply-chain risk.
• The distinction between ARC-MOF DB7 and the Majumdar subset is slightly confusing; the skill references both Zenodo and Materials Cloud sources without fully clarifying the relationship.
• Quality score needs review
• Permission surface needs review: secrets or environment access, shell or command execution
• Stars/forks activity: 161 stars, 24 forks; issue activity unavailable in current metadata
• Dependency/runtime risk: command execution surface, credential or environment access
• Permission surface: secrets or environment access, shell or command execution

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.