Doctor report: ericosiu/ai-marketing-skills@6a66267

[conikeec]

Public GitHub skill URL

https://github.com/ericosiu/ai-marketing-skills/tree/main/sales-playbook

Analyses requested

• [] Follow-through analysis (skillspec doctor)
• Security analysis (skillspec boundary)

Notes

Submitted from the public SkillSpec Doctor page.

[github-actions]

Security analysis — what each skill can reach

0 critical · 1 high · 0 medium · 0 low · 0 clean across 1 skill(s).
1 skill(s) reach beyond their own directory and warrant review before install.

Findings to review

HIGH — .

• 🔴 reads a secret from the environment → AHREFS_API_KEY: can read a token or key held in the environment. — value_pricing_briefing.py:39
• 🔴 reads a secret from the environment → ANTHROPIC_API_KEY: can read a token or key held in the environment. — call_analyzer.py:39
• 🔴 reads a secret from the environment → OPENAI_API_KEY: can read a token or key held in the environment. — call_analyzer.py:40
• 🟠 writes outside its directory → /dev/null: can modify files beyond the skill folder. — SKILL.md:7

What to do next

1. Check and decide. Review the findings above, or re-run the analysis yourself:

skillspec boundary assess https://github.com/ericosiu/ai-marketing-skills/tree/main/sales-playbook

2. Install safely through the gate. Assess, then install only on your approval — across harnesses (Claude, Codex, or any AGENTS.md/SKILL.md skills dir):

skillspec pull https://github.com/ericosiu/ai-marketing-skills/tree/main/sales-playbook

3. Guard your harness. Compile a deny-by-default policy from the surface and enforce it on every tool call, so an unreviewed effect is blocked:

skillspec boundary emit <skill> --format skillspec   # least-privilege policy
skillspec boundary guard install                     # managed PreToolUse hook (observe mode)
skillspec boundary guard mode enforce                # deny effects no policy covers

Static analysis only — nothing in the package was executed. See the boundary guide.

Full analysis artifacts: https://github.com/modiqo/skillspec/actions/runs/30387920290/artifacts/8699702782

The artifact contains: boundary-report.md, boundary-assess.txt, boundary-assess.json.