Security Audit

ailabs-393/ai-labs-claude-skills:packages/skills/test-specialist

github.com/ailabs-393/ai-labs-claude-skills

AI SkillCommit 1a12bc7aadcc

TRUSTED

Scanned 18 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

ailabs-393/ai-labs-claude-skills:packages/skills/test-specialist received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unsafe deserialization / dynamic eval, Potential logging of sensitive input.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on March 14, 2026 (commit 1a12bc7a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

85%

Static Code Analysis

100%

Dependency Graph

100%

LLM Behavioral Safety

100%

Behavioral Risk Signals

Shell Execution

1 finding

Dynamic Code

1 finding

Security Findings2

Severity	Finding	Layer	Location
HIGH	Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions.	Manifest	packages/skills/test-specialist/scripts/analyze_coverage.py:5
INFO	Potential logging of sensitive input The skill's `index.js` logs the entire `input` object to the console and returns it directly. If the input to this skill contains sensitive user data, credentials, or proprietary information, this could lead to unintended exposure via logs or the skill's output. While this is a common pattern for placeholder skills, it's a good practice to sanitize or avoid logging/returning sensitive data. Review the expected input for this skill. If sensitive data is anticipated, ensure it is not logged or returned directly. Implement explicit sanitization or redaction for any sensitive fields before logging or returning the input.	LLM	index.js:3

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/dc7c14bb751d47ff.svg)](https://skillshield.io/report/dc7c14bb751d47ff)