Trust Assessment
graphql received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Excessive 'Bash' permission declared for code-generating agent.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 15, 2026 (commit 1823c3f6). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Excessive 'Bash' permission declared for code-generating agent The skill's manifest declares 'Bash' permission for an agent described as an 'expert GraphQL developer' capable of designing schemas, building resolvers, and implementing APIs. Granting 'Bash' access to an agent that can generate and execute code creates a critical security vulnerability. A malicious prompt injection could instruct the agent to generate and execute arbitrary shell commands, leading to remote code execution, data exfiltration, or system compromise on the host environment. While the provided `SKILL.md` does not explicitly show `Bash` commands, the agent's role implies tasks that might involve command execution (e.g., setting up projects, running build tools), making this permission highly dangerous. Remove or restrict the 'Bash' permission. If shell access is absolutely necessary for specific, well-defined tasks, consider implementing a sandboxed execution environment or providing highly constrained, purpose-built tools instead of full 'Bash' access. For example, specific tools for `npm install` or `git clone` could be exposed instead of a general shell. | LLM | Manifest:1 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | plugins/specweave-backend/skills/graphql/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/fc878b03d9fe1f37)
Powered by SkillShield