brand-alchemy 审计报告.

警告

• The domain_checker.py script performs network lookups, but SKILL.md lacks explicit notes about privacy, rate limits, or that DNS/RDAP checks are only indicative and not full WHOIS verification.
• SKILL.md instructs the AI to read large reference files 'in their entirety' but does not describe how to handle truncated or missing reference files, or what to do if the user cannot provide sufficient discovery details.
• The skill does not define clear limitations for domain checking, such as possible false positives/negatives, TLD quirks, or internationalized domain names.
• Quality score needs review

方法

本报告综合公开元数据、AI 审查输出、仓库活跃度、安装就绪度、OpenAgentSkill 事件、质量评分、信任检查和 Agent 安全门槛；它不是完整的源代码安全审计。