planning Audit report.

Warnings

• Permission surface may require sandboxing
• SKILL.md references external skills and tools (cc10x:verification, cc10x:building, live_harness_runner.py) without explaining how a standalone user should obtain or substitute them.
• No explicit setup or limitations section, so a user outside the cc10x plugin ecosystem may not know what prerequisites are required before using the skill.
• The live verification reference includes potentially destructive commands (db:reset, docker compose down) without a safety note requiring authorization or environment isolation before execution.
• Quality score needs review
• Permission surface needs review: secrets or environment access, shell or command execution
• Stars/forks activity: 164 stars, 25 forks; issue activity unavailable in current metadata
• Permission surface: secrets or environment access, shell or command execution

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.