警告

• 许可证不清晰
• Permission surface may require sandboxing
• Repository license is listed as 'Unknown' in GitHub, but skill metadata and README explicitly state MIT and reference the upstream MIT license. This is a minor compliance ambiguity that should be resolved by confirming/updating the repository license.
• SKILL.md contains cross-references to non-vendored skills (context-degradation, context-optimization) that are not present in this bundle. The README notes these were intentionally removed from routing, but the references in the body remain and could confuse an agent.
• The included Python script (context_manager.py) is a utility with token estimation heuristics; it is not production-grade and may be used by an agent without proper validation. This is not a security risk but could lead to inaccurate context handling if used in operational settings.
• Low GitHub adoption signal
• Quality score needs review
• Permission surface needs review: secrets or environment access, filesystem or document access
• GitHub adoption: 33 GitHub stars
• Stars/forks activity: 33 stars, 3 forks; issue activity unavailable in current metadata
• License clarity: Unknown
• Permission surface: secrets or environment access, filesystem or document access

方法

本报告综合公开元数据、AI 审查输出、仓库活跃度、安装就绪度、OpenAgentSkill 事件、质量评分、信任检查和 Agent 安全门槛；它不是完整的源代码安全审计。