Security audit
Security checks for vulnerabilities and agentic risk
The skill performs a limited local reporting task, but its reports need manual checks because source validation and template handling are incomplete.
Check every figure and source manually. The supplied YAML template currently produces empty report sections because the script expects heading-based notes. Choose an output folder where replacing digest.md is acceptable. Evaluate the optional unsigned Windows app separately; this verdict covers the inspected skill bundle.
Without declared permissions the skill's intent is opaque and cannot be validated.
The manifest promises a source log for every figure, but this loop copies note content into sections without checking or associating figures with sources. Notes containing unsourced revenue, pricing, or customer counts are therefore included unchanged, even when the Source log section is populated only with a 'no notes' placeholder.
No suspicious patterns detected.
