Trust Assessment
brainstorming received a trust score of 94/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Skill requires broad file system and Git access.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 11, 2026 (commit a98c5dfc). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Skill requires broad file system and Git access The skill explicitly instructs the AI to perform operations that require broad read/write access to the project's file system and Git repository. Specifically, it states: 'Check out the current project state first (files, docs, recent commits)', 'Write the validated design to `docs/plans/YYYY-MM-DD-<topic>-design.md`', and 'Commit the design document to git'. While these permissions are often necessary for a development-focused AI agent, they significantly increase the attack surface. Without strict sandboxing and input validation, these capabilities could be exploited for data exfiltration (reading sensitive project files), unauthorized modifications (writing/overwriting files), or command injection (if file paths or commit messages can be manipulated to execute arbitrary commands). Ensure the execution environment strictly sandboxes file system and Git operations, limiting access to the current project directory and preventing arbitrary path traversal or command injection. Implement robust input validation for any user-controlled parts of file paths or content. Consider implementing a 'least privilege' model for AI agent actions. | LLM | SKILL.md:20 |
Scan History
Embed Code
[](https://skillshield.io/report/20b68b66518ae3a7)
Powered by SkillShield