motherduck-build-cfa-app Audit report.

Warnings

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• No critical security risks found. The skill explicitly defers destructive actions, external writes, and scope expansion to user approval, and recommends keeping admin tokens and embed-session creation server-side.
• Minor: SKILL.md does not explicitly call out parameterized queries or strict validation of user-supplied filters and tenant identifiers as a hard requirement, though the allowlisted API contract implies it.
• Quality score needs review
• Permission surface needs review: secrets or environment access, filesystem or document access
• GitHub adoption: 56 GitHub stars
• Stars/forks activity: 56 stars, 3 forks; issue activity unavailable in current metadata
• Dependency/runtime risk: credential or environment access, network or browser surface
• Permission surface: secrets or environment access, filesystem or document access

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.