警告

• Permission surface may require sandboxing
• Financial research output is not financial advice; require human review before any live investment decision
• The provided SKILL.md excerpt is incomplete; the full skill likely contains more detailed instructions, but the available content shows a clear workflow with references to companion files (checklist, components, styles) that ensure quality and consistency.
• Security: The skill instructs the AI to generate HTML with external resources (WebGL shaders, fonts, icons) via CDN or embedded assets, which carries a low supply-chain risk if endpoints are untrusted, but this is standard practice and no explicit dangerous commands or permissions are requested.
• Quality: The skill lacks explicit instructions on how to handle user-provided images or data validation, which could lead to inconsistent output if not covered elsewhere in the full documentation.
• Financial research output is not financial advice; require human review before any live investment decision.
• Permission surface needs review: shell or command execution, filesystem or document access
• Permission surface: shell or command execution, filesystem or document access

方法

本报告综合公开元数据、AI 审查输出、仓库活跃度、安装就绪度、OpenAgentSkill 事件、质量评分、信任检查和 Agent 安全门槛；它不是完整的源代码安全审计。