Security audit
Security checks for vulnerabilities and agentic risk
The launcher fits its stated purpose, but misleading advice about Windows script protections warrants review before installation.
Verify the source and review each script before running it. Unblock only individually reviewed files and avoid the recursive fallback: unblocking removes origin markings and can permit unsigned downloaded scripts under RemoteSigned ([Microsoft documentation](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-5.1)). Keep Defender enabled and respect organizational policies. Review the three separately installed skills before using their workflows.
Without declared permissions the skill's intent is opaque and cannot be validated.
The FAQ recommends removing downloaded-file security markings with Unblock-File while misleadingly claiming Defender has nothing to block because there is no binary; PowerShell scripts can also execute malicious code. Removing Mark of the Web can eliminate origin-based warnings and allow scripts to run under execution policies such as RemoteSigned, increasing risk if downloaded scripts have been tampered with. Reviewing scripts and avoiding administrator privileges reduce potential exposure, but do not make blanket unblocking safe; the exact command and its scope are not provided in this file.
The header at L003-L005 promises that setup does not touch anything outside the user's profile. However, the -Workspace parameter is accepted without a containment check, and L092-L103 create directories and copy configuration into that location, including writable locations outside the profile.
No suspicious patterns detected.
