Security Audit
ailabs-393/ai-labs-claude-skills:packages/skills/brand-analyzer
github.com/ailabs-393/ai-labs-claude-skillsTrust Assessment
ailabs-393/ai-labs-claude-skills:packages/skills/brand-analyzer received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Overly broad file inclusion in package.json.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on March 14, 2026 (commit 1a12bc7a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Overly broad file inclusion in package.json The `package.json` specifies `"files": ["."]`, which instructs package managers to include all files and directories within the package's root directory when publishing. This is an overly broad inclusion and can lead to unintended exposure of sensitive files (e.g., `.env` files, configuration, test data, or temporary files) if they are present in the skill's directory but not meant for distribution. This poses a supply chain risk for consumers of the package. Restrict the `files` array in `package.json` to explicitly list only the necessary files and directories required for the skill to function (e.g., `["index.js", "SKILL.md", "assets/", "references/"]`). Avoid using `["."]` or `"*"`. | Static | package.json:6 |
Scan History
Embed Code
[](https://skillshield.io/report/48fa74bd0c3f6d57)
Powered by SkillShield