Trust Assessment
canvas-design received a trust score of 95/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Local Directory Access, Unconstrained Font Downloads.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unconstrained Font Downloads The skill instructs the LLM to "Download and use whatever fonts are needed." This implies the ability to download files from external sources. Without specifying trusted repositories or requiring strict validation of downloaded content, this opens a vector for supply chain attacks, where malicious font files could be downloaded and potentially exploited. Modify the skill to specify trusted font repositories or require strict validation of downloaded font files. Alternatively, remove the instruction for dynamic font downloads and rely only on pre-approved, locally available fonts. | LLM | SKILL.md:102 | |
| LOW | Local Directory Access The skill instructs the LLM to "Search the `./canvas-fonts` directory." This implies local file system access. While limited to a specific relative path, if the underlying file system access mechanism is not properly sandboxed, it could potentially be exploited for path traversal or unauthorized file access. Ensure the LLM's file system access is strictly sandboxed to prevent path traversal or access to unauthorized directories. If possible, provide fonts directly to the skill rather than requiring it to search a directory. | LLM | SKILL.md:100 |
Scan History
Embed Code
[](https://skillshield.io/report/47f5c9f1d5c0afe3)
Powered by SkillShield