Security Audit
frankxai/claude-skills-library:free-skills/github-project-management
github.com/frankxai/claude-skills-libraryTrust Assessment
frankxai/claude-skills-library:free-skills/github-project-management received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Execution of unpinned and potentially untrusted npm packages via npx.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on October 20, 2026 (commit 93c4aad5). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Execution of unpinned and potentially untrusted npm packages via npx The skill instructions recommend executing commands using `npx claude-flow@alpha` and `npx ruv-swarm`. Running unpinned packages or packages that are not widely recognized standard tools via `npx` introduces a significant supply chain risk. If an attacker registers these package names on the public npm registry, they can achieve arbitrary code execution on the host system when the agent or user runs these commands. Avoid recommending `npx` for unpinned or non-standard packages. If these tools are necessary, instruct the user to install them from a trusted source with strict version pinning, or verify the packages are securely published and maintained. | LLM | SKILL.md:31 |
Scan History
Embed Code
[](https://skillshield.io/report/740153d5fca62578)
Powered by SkillShield