Security Audit
frankxai/claude-skills-library:absorbed/harness/santa-method
github.com/frankxai/claude-skills-libraryTrust Assessment
frankxai/claude-skills-library:absorbed/harness/santa-method received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Arbitrary Code Execution via Local Script Execution Instruction.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on October 20, 2026 (commit 93c4aad5). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary Code Execution via Local Script Execution Instruction The skill instructs the LLM to execute a local script (`node absorbed/harness/santa-round.mjs`) to determine the round counter. If this skill is executed in a repository containing untrusted code (such as during a pull request review), an attacker can modify or supply a malicious `absorbed/harness/santa-round.mjs` file to execute arbitrary commands on the host system running the AI agent. Avoid instructing the LLM to execute arbitrary local scripts from the workspace. Use a built-in state tracking mechanism or ensure that any executed scripts are part of a trusted, read-only toolset rather than the untrusted workspace. | LLM | SKILL.md:10 |
Scan History
Embed Code
[](https://skillshield.io/report/1cbd585c2027ee8b)
Powered by SkillShield