Trust Assessment
tdd-cycle received a trust score of 63/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Direct Shell Command Execution and Data Exfiltration.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 63/100, indicating areas for improvement.
Last analyzed on February 15, 2026 (commit 1823c3f6). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Direct Shell Command Execution and Data Exfiltration The skill contains a direct shell command prefixed with '!' which, if interpreted by the execution environment, would lead to command injection. This command attempts to read content from local files (`.specweave/skill-memories`, `.claude/skill-memories`, `$HOME/.claude/skill-memories`) using `awk`, posing a data exfiltration risk. The command is located within the untrusted input block, indicating that untrusted content could potentially execute arbitrary commands and access local files. While the skill is in 'rubric mode' and examples are generally non-executable, the '!' prefix is a common convention for explicit shell execution in many interactive markdown environments, making this an explicit instruction for execution in such contexts. Remove direct shell command execution from the skill definition. If reading local files is necessary, use a sandboxed file access API provided by the agent framework, ensuring strict path validation and access control. Avoid interpreting '!' as a shell execution trigger for any content, especially untrusted input. | Static | SKILL.md:9 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | plugins/specweave/skills/tdd-cycle/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/99f3d45b3e3bf28b)
Powered by SkillShield