Trust Assessment
senior-qa received a trust score of 69/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 5 findings: 0 critical, 0 high, 4 medium, and 1 low severity. Key findings include Network egress to untrusted endpoints, Covert behavior / concealment directives, Arbitrary File Write via --output argument.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 458b1186). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | cli-tool/components/mcps/devtools/figma-dev-mode.json:4 | |
| MEDIUM | Arbitrary File Write via --output argument The Python scripts (`scripts/coverage_analyzer.py`, `scripts/e2e_test_scaffolder.py`, `scripts/test_suite_generator.py`) allow writing the generated JSON report to an arbitrary file path specified by the `--output` command-line argument. While the current report content is benign (status, target path, findings count), the capability to write to any file on the system could be abused by a malicious actor to overwrite critical system files, potentially leading to denial of service or system instability, especially if the script is executed with elevated privileges. There is no validation or restriction on the provided output path. Implement strict validation for the `--output` argument to ensure files are only written to a designated, non-sensitive directory (e.g., a temporary directory or a user-specified output folder within the project scope). Alternatively, consider making stdout the default output and requiring explicit confirmation or a restricted path for file output. | Static | scripts/coverage_analyzer.py:108 | |
| MEDIUM | Arbitrary File Write via --output argument The Python scripts (`scripts/coverage_analyzer.py`, `scripts/e2e_test_scaffolder.py`, `scripts/test_suite_generator.py`) allow writing the generated JSON report to an arbitrary file path specified by the `--output` command-line argument. While the current report content is benign (status, target path, findings count), the capability to write to any file on the system could be abused by a malicious actor to overwrite critical system files, potentially leading to denial of service or system instability, especially if the script is executed with elevated privileges. There is no validation or restriction on the provided output path. Implement strict validation for the `--output` argument to ensure files are only written to a designated, non-sensitive directory (e.g., a temporary directory or a user-specified output folder within the project scope). Alternatively, consider making stdout the default output and requiring explicit confirmation or a restricted path for file output. | Static | scripts/e2e_test_scaffolder.py:108 | |
| MEDIUM | Arbitrary File Write via --output argument The Python scripts (`scripts/coverage_analyzer.py`, `scripts/e2e_test_scaffolder.py`, `scripts/test_suite_generator.py`) allow writing the generated JSON report to an arbitrary file path specified by the `--output` command-line argument. While the current report content is benign (status, target path, findings count), the capability to write to any file on the system could be abused by a malicious actor to overwrite critical system files, potentially leading to denial of service or system instability, especially if the script is executed with elevated privileges. There is no validation or restriction on the provided output path. Implement strict validation for the `--output` argument to ensure files are only written to a designated, non-sensitive directory (e.g., a temporary directory or a user-specified output folder within the project scope). Alternatively, consider making stdout the default output and requiring explicit confirmation or a restricted path for file output. | Static | scripts/test_suite_generator.py:108 | |
| LOW | Covert behavior / concealment directives Multiple zero-width characters (stealth text) Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | cli-tool/components/mcps/devtools/jfrog.json:4 |
Scan History
Embed Code
[](https://skillshield.io/report/4a315c700e088a20)
Powered by SkillShield