talk-review Audit report.

Warnings

• ASR and resume content are untrusted inputs; although the workflow requires user confirmation and preserves uncertainty, SKILL.md does not explicitly state that instructions embedded in ASR/resume files must never be treated as commands. This is a minor prompt-injection hardening gap.
• The skill depends on hidden OfferLoop runtime files and scripts; outside that exact environment, operation may fail without a clear fallback beyond routing to --setup.
• Low GitHub adoption signal
• Quality score needs review
• GitHub adoption: 13 GitHub stars
• Stars/forks activity: 13 stars, 0 forks; issue activity unavailable in current metadata

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.