Trust Assessment
security-patterns received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Embedded Shell Command in Skill Definition.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 15, 2026 (commit 1823c3f6). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Embedded Shell Command in Skill Definition The skill definition contains an embedded shell command (`!s="..."`) within the untrusted content block. This command attempts to execute arbitrary shell code, including iterating through directories, checking file existence, and processing files with `awk`. If the system parsing this skill definition executes this command, it constitutes a severe command injection vulnerability. The command also attempts to access files in the user's home directory (`$HOME/.claude/skill-memories`), which could lead to data exfiltration. Remove all executable shell commands or dynamic code execution attempts from skill definition files, especially within sections designated as untrusted content. Skill definitions should be declarative, not executable. If dynamic loading of content is required, it should be done through a secure, sandboxed mechanism, not direct shell execution. | LLM | SKILL.md:11 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | plugins/specweave/skills/security-patterns/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/fef6d0e59c078516)
Powered by SkillShield