architect-specify Audit report.

Warnings

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• Financial research output is not financial advice; require human review before any live investment decision
• The skill relies on external bash scripts that are sourced from the project root or script directory; if an attacker can place a malicious common.sh in the project root, it could be executed. However, this is a general risk for any script that sources external files and is not specific to this skill.
• The SKILL.md excerpt is truncated, but the provided content is clear and complete enough for evaluation.
• Financial research output is not financial advice; require human review before any live investment decision.
• Quality score needs review
• Permission surface needs review: secrets or environment access, shell or command execution
• Stars/forks activity: 132 stars, 1 forks; issue activity unavailable in current metadata
• Dependency/runtime risk: credential or environment access, network or browser surface
• Permission surface: secrets or environment access, shell or command execution

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.