spec-first Audit report.

Warnings

• License is unclear
• Dependency or permission surface needs review
• Permission surface may require sandboxing
• Financial research output is not financial advice; require human review before any live investment decision
• The SKILL.md mentions a todo.md artifact in the description, but the Creates/Modifies section only lists spec and decision files; clarify whether todo.md is written to disk or exists only as a GitHub Issue body.
• No explicit prerequisites/setup section is present; the workflow assumes gh CLI availability, authentication, and an .agents/memory/ directory convention.
• Repository license is detected as Unknown by GitHub, though plugin.json declares MIT; a LICENSE file should be included for clearer compliance.
• Low GitHub adoption signal
• Financial research output is not financial advice; require human review before any live investment decision.
• Quality score needs review
• Permission surface needs review: secrets or environment access, shell or command execution
• GitHub adoption: 35 GitHub stars

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.