Security Audit
filesystem-context
github.com/muratcankoylan/Agent-Skills-for-Context-EngineeringTrust Assessment
filesystem-context received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Persistent Prompt Injection via Self-Modification, Path Traversal in ScratchPadManager.offload.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on August 1, 2026 (commit c578e85e). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Persistent Prompt Injection via Self-Modification Pattern 6 ('Learning Through Self-Modification') describes a mechanism where agents write learned preferences and patterns to their own instruction files (e.g., 'agent/user_preferences.yaml') so subsequent sessions load this context automatically. If an attacker can influence these preferences (e.g., via indirect prompt injection from web search or user input), they can inject persistent malicious instructions that will be loaded in subsequent sessions, leading to persistent agent compromise. Avoid allowing the agent to automatically write to instruction or system preference files without explicit human-in-the-loop approval. If self-modification is necessary, strictly validate and sanitize the keys and values against a strict schema, and do not treat these files as executable instructions or system prompts. | LLM | SKILL.md:138 | |
| MEDIUM | Path Traversal in ScratchPadManager.offload The 'offload' method in 'ScratchPadManager' constructs a file path using 'self.base_path / filename', where 'filename' is formatted as 'f"{source}_{timestamp}.txt"'. If the 'source' parameter is derived from untrusted input (such as a user-controlled tool name or external source identifier) and contains path traversal sequences (e.g., '../../'), it can resolve to a path outside the intended 'scratch' directory, leading to arbitrary file write. Sanitize the 'source' parameter to ensure it does not contain path traversal characters (like '/' or '..'), or resolve the path and verify that it remains within 'self.base_path'. | LLM | scripts/filesystem_context.py:71 |
Scan History
Embed Code
[](https://skillshield.io/report/977cdea9b0f21ad2)
Powered by SkillShield