Trust Assessment
compound-engineering received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 1 low severity. Key findings include Node lockfile missing, Agent instructed to commit potentially sensitive learnings to Git.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Agent instructed to commit potentially sensitive learnings to Git The skill explicitly instructs the AI agent to 'Extract learnings and patterns' from daily work sessions and then 'Commit and push changes' to a Git repository. If the agent processes sensitive user data, these 'learnings' could inadvertently contain and expose confidential information. Committing such data to a Git repository, especially if it's public or accessible to unauthorized parties, constitutes a data exfiltration risk. The skill does not specify access controls or the nature of the Git repository. Users should ensure that the AI agent operates in an environment where sensitive data is not processed, or that the Git repository used for memory storage is private, properly secured, and has strict access controls. Implement data sanitization or redaction mechanisms for extracted learnings before committing to version control. | LLM | SKILL.md:68 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/lxgicstudios/compound-calc/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/5c5ca27dc1079d04)
Powered by SkillShield