Trust Assessment
docs-updater received a trust score of 56/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 1 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Sensitive environment variable access: $HOME, Direct Shell Command Execution in Markdown.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 15, 2026 (commit 1823c3f6). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Direct Shell Command Execution in Markdown The skill package contains a direct shell command embedded within the markdown file. This allows for arbitrary command execution on the host system. While the current command uses `awk` to read a specific section from a markdown file, this mechanism demonstrates a critical vulnerability where any shell command could be injected and executed, leading to full system compromise, data exfiltration, or denial of service. Remove direct shell command execution from markdown files. If specific functionality is required, it should be implemented in a sandboxed environment or through a secure, controlled API that validates and sanitizes all inputs. Avoid embedding executable code directly in documentation or configuration files that are processed by the host LLM. | LLM | SKILL.md:5 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | plugins/specweave/skills/docs-updater/SKILL.md:1 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | plugins/specweave/skills/docs-updater/SKILL.md:6 |
Scan History
Embed Code
[](https://skillshield.io/report/5953ebd37a1fc374)
Powered by SkillShield