webflow-code-component:component-scaffold Audit report.

Warnings

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• Financial research output is not financial advice; require human review before any live investment decision
• The provided SKILL.md excerpt is truncated at Phase 2 item 7, so the full conflict-handling and file-generation steps could not be verified.
• Component name validation is mentioned only as PascalCase; there is no explicit guard against unsafe filesystem characters or path traversal when creating files.
• The skill can trigger `npm install` for dependencies; while it offers the option to the user, it should more explicitly require approval and recommend verifying package integrity/lockfiles.
• Financial research output is not financial advice; require human review before any live investment decision.
• Quality score needs review
• Permission surface needs review: shell or command execution, filesystem or document access
• Stars/forks activity: 114 stars, 18 forks; issue activity unavailable in current metadata
• Dependency/runtime risk: command execution surface, external package install surface
• Permission surface: shell or command execution, filesystem or document access

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.