motherduck-build-dashboard Audit report.

Warnings

• Permission surface may require sandboxing
• The skill relies on several companion skills (motherduck-explore, motherduck-query, motherduck-create-dive, motherduck-design-dive, motherduck-duckdb-sql) and assumes they are available in the target environment; missing dependencies would degrade the workflow.
• SKILL.md does not explicitly list credential or environment setup steps for MotherDuck access, though the artifacts and related skills imply them.
• The familiar 'ask before destructive replacement' guard is present, but the skill could be more explicit about refusing or confirming destructive SQL such as DROP, TRUNCATE, or DELETE against production data.
• Quality score needs review
• Permission surface needs review: secrets or environment access, filesystem or document access
• GitHub adoption: 56 GitHub stars
• Stars/forks activity: 56 stars, 3 forks; issue activity unavailable in current metadata
• Permission surface: secrets or environment access, filesystem or document access

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.