openai-symphony-autonomous-agents
github.com/aradotso/trending-skills
Scanned Thu, 28 May 2026 17:11:40 GMT
Scan ID crawl-m2rkrt3sb6nx29fphgbkb4o8 · 3ms
B
SCORE 75 / 100
Verdict: Safe to install
4 medium findings.
This skill spawns subprocesses outside its declared capabilities plus 3 other issues listed below.
0 critical0 high4 medium8 rules passed
Why grade B?
score · 75 / 100The current grade reflects 4 medium findings (3+ MEDs → B).
0 CRIT0 HIGH4 MED0 LOW
To reach a higher grade
- AReach Atarget score 95
Resolve 2 of 4 MED (cap is 2).
Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.
Findings · ordered by severity
medArbitrary subprocess execution detectedThe skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.▾
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
391 defp spawn_agent(task) do
392 parent = self()
393 spawn(fn ->← spawns a subprocess outside declared capabilities
394 result = Symphony.AgentRunner.run(task)
395 send(parent, {:agent_done, result})
medNo capability manifest declaredThe skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.rule: no-manifest▾
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule:
no-manifestmedLink text shows "spec.md" but points at github.comThe visible link text contains the domain `spec.md`, but the URL actually targets `github.com`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.▾
Link text shows "spec.md" but points at github.com
The visible link text contains the domain `spec.md`, but the URL actually targets `github.com`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.
439## Resources
440
441- [SPEC.md](https://github.com/openai/symphony/blob/main/SPEC.md) — Full Symphony specification← text→spec.md · href→github.com
442- [elixir/README.md](https://github.com/openai/symphony/blob/main/elixir/README.md) — Elixir setup guide
443- [Harness Engineering](https://openai.com/index/harness-engineering/) — Prerequisite methodology
medLink text shows "readme.md" but points at github.comThe visible link text contains the domain `readme.md`, but the URL actually targets `github.com`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.▾
Link text shows "readme.md" but points at github.com
The visible link text contains the domain `readme.md`, but the URL actually targets `github.com`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.
440
441- [SPEC.md](https://github.com/openai/symphony/blob/main/SPEC.md) — Full Symphony specification
442- [elixir/README.md](https://github.com/openai/symphony/blob/main/elixir/README.md) — Elixir setup guide← text→readme.md · href→github.com
443- [Harness Engineering](https://openai.com/index/harness-engineering/) — Prerequisite methodology
444- [Apache 2.0 License](https://github.com/openai/symphony/blob/main/LICENSE)
skillox.io/r/crawl-m2rkrt3sb6nx29fphgbkb4o8