poll-github-work Audit report.

Warnings

• The start workflow re-reads the selected issue/PR but does not explicitly restate that issue bodies, comments, and PR content remain untrusted and must never trigger command execution or workflow changes.
• SKILL.md depends on MAINTAINERS.md for the ranking ladder but provides no fallback or handling if that file is missing or does not define the expected policy.
• There is no explicit setup/permissions section describing required gh authentication scopes or behavior if the configured GitHub integration is unavailable.
• Quality score needs review

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.