Doctor report: ericosiu/ai-marketing-skills@6a66267 #52

Activity

1. conikeec

   added

   doctor-reportPublic SkillSpec doctor report requestPublic SkillSpec doctor report request

   on Jul 28, 2026
2. github-actions commented on Jul 28, 2026

   

   github-actionsbot

   on Jul 28, 2026 – with GitHub Actions

   More actions

   Security analysis — what each skill can reach

   0 critical · 1 high · 0 medium · 0 low · 0 clean across 1 skill(s).
   1 skill(s) reach beyond their own directory and warrant review before install.

   Findings to review

   HIGH — .

   • 🔴 reads a secret from the environment → AHREFS_API_KEY: can read a token or key held in the environment. — value_pricing_briefing.py:39
   • 🔴 reads a secret from the environment → ANTHROPIC_API_KEY: can read a token or key held in the environment. — call_analyzer.py:39
   • 🔴 reads a secret from the environment → OPENAI_API_KEY: can read a token or key held in the environment. — call_analyzer.py:40
   • 🟠 writes outside its directory → /dev/null: can modify files beyond the skill folder. — SKILL.md:7

   What to do next

   1. Check and decide. Review the findings above, or re-run the analysis yourself:

   skillspec boundary assess https://github.com/ericosiu/ai-marketing-skills/tree/main/sales-playbook

   2. Install safely through the gate. Assess, then install only on your approval — across harnesses (Claude, Codex, or any AGENTS.md/SKILL.md skills dir):

   skillspec pull https://github.com/ericosiu/ai-marketing-skills/tree/main/sales-playbook

   3. Guard your harness. Compile a deny-by-default policy from the surface and enforce it on every tool call, so an unreviewed effect is blocked:

   skillspec boundary emit <skill> --format skillspec   # least-privilege policy
   skillspec boundary guard install                     # managed PreToolUse hook (observe mode)
   skillspec boundary guard mode enforce                # deny effects no policy covers

   Static analysis only — nothing in the package was executed. See the boundary guide.

   Full analysis artifacts: https://github.com/modiqo/skillspec/actions/runs/30387920290/artifacts/8699702782

   The artifact contains: boundary-report.md, boundary-assess.txt, boundary-assess.json.