api-graphql Audit report.

Warnings

• Permission surface may require sandboxing
• Potential broker, wallet, exchange, or real-money execution surface; sandbox and explicit approval are required
• SKILL.md does not include an explicit authorization and scope statement; it assumes pentest/bugbounty context but should clearly state that testing is only permitted on systems the user owns or is explicitly authorized to assess.
• The DoS/cost section could be misused if not carefully scoped; it mentions respecting program rules but should add a stronger warning against performing actual denial-of-service or brute-force attacks on unauthorized systems.
• Low GitHub adoption signal
• This skill may touch real-money trading, broker, wallet, or exchange operations; use only in a sandbox with explicit approval.
• Quality score needs review
• Permission surface needs review: secrets or environment access, network or browser access
• GitHub adoption: 20 GitHub stars
• Stars/forks activity: 20 stars, 7 forks; issue activity unavailable in current metadata
• Permission surface: secrets or environment access, network or browser access

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.