Scan Report
10 /100
agent-Andri
Agent Andri — periodic status reporter writing to meeting-room file
A simple local status-reporting agent that periodically writes to a flat text file in a designated directory, with behavior fully aligned with its documentation.
Safe to install
Skill is safe to use. The infinite while-loop in status_report.sh is a minor design concern for long-running sessions but does not constitute a security threat.
Findings 2 items
| Severity | Finding | Location |
|---|---|---|
| Low | Writes to hidden dot-directory under $HOME Sensitive Access | scripts/status_report.sh:9 |
| Low | Infinite loop without signal handling Sensitive Access | scripts/status_report.sh:12 |
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ | WRITE | ✓ Aligned | SKILL.md declares writing to ~/.../to_leader.txt; scripts/status_report.sh line … |
File Tree
2 files · 983 B · 26 lines Shell 1f · 15L
Markdown 1f · 11L
├─
▾
scripts
│ └─
status_report.sh
Shell
└─
SKILL.md
Markdown
Security Positives
✓ All capabilities declared in SKILL.md are used exactly as documented
✓ No external network requests or data exfiltration
✓ No credential harvesting or environment variable exfiltration
✓ No obfuscation, base64 encoding, or suspicious code patterns
✓ No sensitive file paths (~/.ssh, ~/.aws, .env) accessed
✓ No remote script execution (curl|bash, wget|sh)
✓ No supply-chain risks — no dependencies declared or used
✓ Script uses set -euo pipefail for safe shell execution