Security Audit
game-changing-features
github.com/davila7/claude-code-templatesTrust Assessment
game-changing-features received a trust score of 84/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 0 high, 2 medium, and 1 low severity. Key findings include Network egress to untrusted endpoints, Covert behavior / concealment directives, Explicit instruction to write all responses to a local file.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 458b1186). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | cli-tool/components/mcps/devtools/figma-dev-mode.json:4 | |
| MEDIUM | Explicit instruction to write all responses to a local file The skill explicitly instructs the LLM to direct 'ALL responses' to a specific local file path (`.claude/docs/ai/<product-or-area>/10x/session-N.md`). If the LLM's runtime environment interprets this as a command to write to the filesystem, this could lead to uncontrolled local file creation/modification. Sensitive information provided by the user (e.g., in 'Product/Area', 'Current state', 'Constraints') or generated by the LLM could be written to this file, potentially leading to data leakage if the agent's workspace is not properly secured or if the file is inadvertently accessed. While the skill is noted as a 'security rubric' with 'non-executable examples', this specific instruction is an imperative command to the LLM regarding its output behavior, which, if acted upon by the agent's environment, constitutes a file write operation. 1. If the LLM is not intended to perform file system operations, rephrase the instruction to clarify it's an illustrative output format, e.g., 'Format output as if it were being saved to a file at `.claude/docs/ai/...`'. 2. If file writing is intended, ensure the agent's environment strictly sandboxes file operations to a secure, ephemeral workspace. 3. Implement input sanitization or explicit warnings if user-provided data that could be sensitive is intended to be written to the file. 4. Consider if writing 'ALL responses' to a file is necessary, or if only specific, non-sensitive outputs should be saved. | LLM | SKILL.md:10 | |
| LOW | Covert behavior / concealment directives Multiple zero-width characters (stealth text) Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | cli-tool/components/mcps/devtools/jfrog.json:4 |
Scan History
Embed Code
[](https://skillshield.io/report/e93987dbcf5a85b2)
Powered by SkillShield