Security Audit
Luispitik/ux-ui-premium-direction-style-selector:ux-ui-premium-direction-style-selector
github.com/Luispitik/ux-ui-premium-direction-style-selectorTrust Assessment
Luispitik/ux-ui-premium-direction-style-selector:ux-ui-premium-direction-style-selector received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Skill requires broad filesystem and command execution permissions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on March 19, 2026 (commit 0edd2b1a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Skill requires broad filesystem and command execution permissions The skill instructs the agent to perform extensive file system operations, including reading existing project files (e.g., `src/app/`, `tailwind.config.ts`, `globals.css`, `CLAUDE.md`, 'existing pages', 'spec docs') and writing new files or modifying existing ones (e.g., `src/app/demo/layout.tsx`, `src/app/demo/page.tsx`, `tailwind.config.ts`, `globals.css`, `src/components/ui/Button.tsx`, etc.). Additionally, it explicitly requires the execution of shell commands such as `npx next build` and starting a development server. While these actions are necessary for the skill's stated purpose of generating and applying UI/UX themes, they grant the agent significant control over the user's codebase and local environment. A compromised agent or skill could exploit this level of access for data exfiltration, arbitrary code injection into the user's project, or broader system compromise if the execution environment is not adequately sandboxed. Ensure the agent operates within a strictly sandboxed environment with minimal necessary permissions. Implement robust input validation and output sanitization for any user-provided data that might influence file paths or command arguments (though no direct injection points are visible in this skill definition). Users should be made aware of the extensive file system and execution access this skill requires before activation. | LLM | SKILL.md:63 |
Scan History
Embed Code
[](https://skillshield.io/report/023b8c7c04bdc28f)
Powered by SkillShield