Trust Assessment
agent-config received a trust score of 90/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Skill instructs writing to absolute path outside primary scope.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Skill instructs writing to absolute path outside primary scope The skill explicitly instructs the LLM to log significant changes to an absolute file path (`/Users/macmini/Sizemore/agent/decisions/config-changes.md`). This path is outside the `~/clawd/` directory, which appears to be the primary working directory for agent configuration files. While logging is a common task, writing to specific absolute paths outside the skill's declared primary operational scope could indicate excessive permissions or a lack of sandboxing, potentially allowing writes to unintended locations if the path is not strictly controlled by the environment. Modify the logging instruction to use a relative path within the agent's designated working directory (e.g., `~/clawd/decisions/config-changes.md`) or ensure the absolute path is explicitly sanctioned and sandboxed for this skill. Consider using a dedicated logging tool/API if available, which might offer better permission control. | LLM | SKILL.md:196 | |
| MEDIUM | Skill instructs writing to absolute path outside primary scope The skill explicitly instructs the LLM to log failed changes to an absolute file path (`/Users/macmini/Sizemore/agent/learnings/config-failures.md`). This path is outside the `~/clawd/` directory, which appears to be the primary working directory for agent configuration files. While logging is a common task, writing to specific absolute paths outside the skill's declared primary operational scope could indicate excessive permissions or a lack of sandboxing, potentially allowing writes to unintended locations if the path is not strictly controlled by the environment. Modify the logging instruction to use a relative path within the agent's designated working directory (e.g., `~/clawd/learnings/config-failures.md`) or ensure the absolute path is explicitly sanctioned and sandboxed for this skill. Consider using a dedicated logging tool/API if available, which might offer better permission control. | LLM | SKILL.md:235 |
Scan History
Embed Code
[](https://skillshield.io/report/a32595402b9e26ef)
Powered by SkillShield