openai-symphony-autonomous-agents

github.com/aradotso/trending-skills
Verdict: Generally safe
0 critical0 high4 medium
B
SCORE 75 / 100
$skillox install openai-symphony-autonomous-agentsSoon
Sign in to followFollowing emails you when a re-scan drops the grade. Opt-out is per-creator on /account/billing.

Why grade B?

score · 75 / 100

The current grade reflects 4 medium findings (3+ MEDs → B).

0 CRIT0 HIGH4 MED0 LOW
To reach a higher grade
  • A
    Reach Atarget score 95

    Resolve 2 of 4 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Latest scan findings

Scan crawl-m2rkrt3sb6nx29fphgbkb4o8 · Thu, 28 May 2026 17:11:40 GMT · 3ms

med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 393CWE-78
▾
391 defp spawn_agent(task) do
392 parent = self()
393 spawn(fn ->← spawns a subprocess outside declared capabilities
394 result = Symphony.AgentRunner.run(task)
395 send(parent, {:agent_done, result})
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
med
Link text shows "spec.md" but points at github.com
The visible link text contains the domain `spec.md`, but the URL actually targets `github.com`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.
rule: anchor-href-mismatchline: 441CWE-601
▾
439## Resources
440
441- [SPEC.md](https://github.com/openai/symphony/blob/main/SPEC.md) — Full Symphony specification← text→spec.md · href→github.com
442- [elixir/README.md](https://github.com/openai/symphony/blob/main/elixir/README.md) — Elixir setup guide
443- [Harness Engineering](https://openai.com/index/harness-engineering/) — Prerequisite methodology
med
Link text shows "readme.md" but points at github.com
The visible link text contains the domain `readme.md`, but the URL actually targets `github.com`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.
rule: anchor-href-mismatchline: 442CWE-601
▾
440
441- [SPEC.md](https://github.com/openai/symphony/blob/main/SPEC.md) — Full Symphony specification
442- [elixir/README.md](https://github.com/openai/symphony/blob/main/elixir/README.md) — Elixir setup guide← text→readme.md · href→github.com
443- [Harness Engineering](https://openai.com/index/harness-engineering/) — Prerequisite methodology
444- [Apache 2.0 License](https://github.com/openai/symphony/blob/main/LICENSE)
View latest scan →
skillox.io/c/openai-symphony-autonomous-agents