Skill Audit Guardian

• Verdict: Pass
• Confidence: Medium
• Analyzed: Feb 23, 2026, 2:26 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill's code and runtime instructions are coherent with its stated purpose (scanning, classifying, and sorting skill ZIPs) with some minor engineering issues to address before trusted use.

This package appears to do what it says: static-scans ZIPs, scores them, moves them into risk folders, and builds a local HTML dashboard. Before installing or running: 1) Review and (preferably) remove or update the hardcoded paths (/Users/gascomp/...) in the watcher and dashboard scripts so they use the package-relative scripts and an output path appropriate for your environment; otherwise the watcher may call non-existent or unexpected scripts. 2) Ensure standard utilities used by the scripts (shasum, realpath, find, xargs) exist on your system — they are used but not listed in the declared required bins. 3) Run one-shot audits on test ZIPs in an isolated environment first to verify behavior, and confirm the watcher’s automatic mv behavior is acceptable (it moves originals into safe/caution/remove/failed). 4) Treat CAUTION/REMOVE results as heuristics (false positives are possible); perform manual review before exposing keys or installing. If you want extra assurance, run the audit scripts under a non-privileged account or in a disposable VM/container.