Trust Assessment
changelog-gen received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Git Log Data Sent to External LLM, Unpinned `npx` Dependency.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Git Log Data Sent to External LLM The skill describes a tool (`ai-changelog`) that collects git commit messages and explicitly states it 'sends them to GPT-4o-mini'. This constitutes data exfiltration of potentially sensitive repository information (e.g., commit messages, author details, code snippets within messages) to a third-party AI service. Users should be aware of the privacy implications and potential for sensitive data leakage when using this tool. Advise users of the data privacy implications and the nature of data shared with external services. For the tool itself, consider implementing local processing options or explicit user consent/redaction mechanisms for sensitive data before transmission. | LLM | SKILL.md:57 | |
| MEDIUM | Unpinned `npx` Dependency The skill instructs users to run `npx ai-changelog` without specifying a version. This means `npx` will always fetch and execute the latest version of the `ai-changelog` package from npm. This introduces a supply chain risk, as a malicious or breaking update to the package could be automatically executed without user review, potentially leading to command injection, data exfiltration, or other compromises. Pin the dependency to a specific version (e.g., `npx ai-changelog@1.2.3`) to ensure consistent and reviewed behavior. Regularly audit the specified version for vulnerabilities and update cautiously. | LLM | SKILL.md:10 |
Scan History
Embed Code
[](https://skillshield.io/report/8c70265609e60d1d)
Powered by SkillShield