Trust Assessment
java-spring received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Excessive permissions declared: Unrestricted Bash access.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 15, 2026 (commit 1823c3f6). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Excessive permissions declared: Unrestricted Bash access The skill's manifest declares 'Bash' as an allowed tool, granting the agent the ability to execute arbitrary shell commands on the host system. This is a critical security risk as it can lead to full system compromise, data exfiltration, or installation of malicious software. While a developer agent might need to run build commands, unrestricted 'Bash' access is overly broad and provides a significant attack surface. Additionally, 'Write' and 'Edit' permissions grant broad filesystem access, further increasing the potential for harm. Remove or severely restrict 'Bash' access. If specific shell commands are absolutely necessary, consider creating dedicated, sandboxed tools for those specific commands rather than granting general 'Bash' access. Re-evaluate the necessity and scope of 'Write' and 'Edit' permissions and narrow them down to specific directories or file types if possible. | LLM | Manifest | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | plugins/specweave-backend/skills/java-spring/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/95a134afed7f7466)
Powered by SkillShield