ModelsAtlas
Explore
Atlas / Skills / maxritter / Workflows

WorkflowsBLOCK

skills/maxritter/workflows
Agent skill by maxritter · agent skills · agentic engineering · ai coding · Audited 2026-10-08
⚑ Report / re-scanSource ↗

Professional context and harness engineering for Claude Code and OpenAI Codex. Build production-grade software with spec-driven development, TDD, persistent memory, quality gates, code intelligence, human oversight, and end-to-end verification.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Version
—
Hosts
2 documented
License
NOASSERTION
Stars
2,084
01

Overview

Professional context and harness engineering for Claude Code and OpenAI Codex. Build production-grade software with spec-driven development, TDD, persistent memory, quality gates, code intelligence, human oversight, and end-to-end verification.

Read from source at commit 7e3c9718babeOBSERVED · 2026-10-08
02

Host compatibility

What the documentation claims. We have not run a compatibility test.

HostStatusNotes
claude-codementioned
codexmentioned
03

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (8)

HIGHSupply chain · supply.pipe_to_shell · CWE-829, CWE-1357
pilot/hooks/license_check.py:72
"curl -fsSL https://raw.githubusercontent.com/maxritter/pilot-shell/main/uninstall.sh | bash"
Why it matters. remote content executed unseen
Fix. download, verify a checksum, then run
MEDIUMInventory / provenance · inv.binary · CWE-1104
console/src/services/worker/http/routes/LicenseRoutes.ts
LicenseRoutes.ts
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
console/src/ui/viewer/components/LicenseBadge.tsx
LicenseBadge.tsx
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
console/src/ui/viewer/components/LicenseGate.tsx
LicenseGate.tsx
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · skill.no_skill_md · CWE-1104
Why it matters. no SKILL.md at the audited path
Fix. a skill without its instruction file cannot be reviewed as one
LOWInventory / provenance · inv.binary · CWE-1104
console/tests/integration/license-recovery-worker.test.ts
license-recovery-worker.test.ts
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
console/tests/server/license-routes.test.ts
license-routes.test.ts
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
ui-design.md:86
- Linux and WSL2: current-user-owned `0600` file at `~/.config/open-claude-design/credentials.json`.
Why it matters. asks the agent to read credentials

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha 7e3c9718babefull audit observations/trust-audit/skill/maxritter__workflows.json · Report an issue / request a re-scan
04

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-087e3c9718babeBLOCKD69first audit
05

Questions

What does the Workflows skill do?

Professional context and harness engineering for Claude Code and OpenAI Codex. Build production-grade software with spec-driven development, TDD, persistent memory, quality gates, code intelligence, human oversight, and end-to-end verification.

Is Workflows safe to install?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What can Workflows access on my machine?

The audit observed no filesystem, network or shell use at all in its source.

Which assistants does Workflows work with?

Its documentation mentions claude-code and codex. That is what the text claims, not a compatibility test we ran.

How current is this page?

The grade is for one exact copy of the source (7e3c9718babe), read on 2026-10-08. The repository is watched, and a new audit runs when it changes — this is the first audit.

Advertisement