Trust Assessment
ado-resource-validator received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Potentially excessive 'Bash' permission.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 15, 2026 (commit 1823c3f6). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | plugins/specweave-ado/skills/ado-resource-validator/SKILL.md:1 | |
| MEDIUM | Potentially excessive 'Bash' permission The skill declares 'Bash' permission, which grants it the ability to execute arbitrary shell commands. However, the provided implementation details and TypeScript code snippets primarily describe API interactions, file system operations (reading/writing .env files), and interactive prompts, none of which inherently require direct shell execution. While the skill mentions creating folder structures and being invoked via CLI, these actions can typically be performed using Node.js native `fs` module functions or are external invocations of the skill itself, not internal `bash` commands executed by the skill. Granting `Bash` permission when not strictly necessary increases the attack surface. Review the skill's full source code (`src/utils/external-resource-validator.ts`) to confirm if direct shell command execution is truly required. If not, remove 'Bash' from the declared permissions. For file system operations like creating directories, prefer using Node.js native `fs` module functions (e.g., `fs.mkdirSync`) over shell commands. | Static | SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/38ae779267ae9c8c)
Powered by SkillShield