What the reviewer found
An internal ops runbook (Weblyfe/Orgo) for provisioning a client's bot: it reads the operator's own ~/.weblyfe-secrets vault to pass Orgo/OpenRouter/Telegram/Vercel keys into orgo.ai and GitHub API calls that are the whole point of the workflow, generates a new SSH deploy key, and installs uv via astral.sh's own installer. These are the operator's own credentials sent only to the vendors that issued them, not stolen or exfiltrated elsewhere; it will simply no-op for anyone without this org's secret files.
credential-access— reads credentialsnetwork— calls the vendor’s APIinstalls-software— installs software
What was read
The file as it ships in S3YED/appie-kit:
skills/client/client-orgo-provisioning/SKILL.md
What the static scan said
The scan flagged 5things. The reviewer kept 0 and dismissed 5 as false.
E2Harvests environment variables — false positivePE2Asks for root — false positivePE3Reaches for credential files — false positiveSC2Downloads and executes remote code — false positiveNETMakes network calls — false positive
How this review was made
Sonnet 5 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.