attack-surface Audit report.

Warnings

• Permission surface may require sandboxing
• SKILL.md does not include an explicit authorization/scope guardrail; it assumes an engagement is already authorized but does not instruct the agent to verify scope boundaries.
• Phase 3 depends on a `check-exploit` skill that is not bundled or described, so the workflow may be incomplete if that skill is unavailable.
• Phase 1 provides categories but no concrete read-only enumeration tooling or commands, making output quality dependent on the model's prior knowledge.
• Low GitHub adoption signal
• Quality score needs review
• Permission surface needs review: secrets or environment access, filesystem or document access
• GitHub adoption: 36 GitHub stars
• Stars/forks activity: 36 stars, 9 forks; issue activity unavailable in current metadata
• Permission surface: secrets or environment access, filesystem or document access

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.