Trust Assessment
consensus-interact received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Skill documentation suggests storing highly sensitive Supabase Service Role Key in plain text config.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Skill documentation suggests storing highly sensitive Supabase Service Role Key in plain text config The `SKILL.md` provides configuration examples for Supabase integration that include `serviceRoleKey`. This key typically grants full administrative access, bypassing Row Level Security. The documentation suggests placing this key directly into a local configuration file (e.g., `consensus-tools.json` when `local.storage.kind` is `json`), which increases the risk of accidental exposure (e.g., via version control, insecure file permissions, or local file access by other processes). While the skill itself does not exfiltrate this key, it guides the user to store a highly privileged credential in a potentially insecure manner. Advise users to use environment variables, a secrets management system, or a more secure configuration method for highly sensitive keys like `serviceRoleKey`. If stored in a file, ensure strict file permissions and explicitly warn against committing such files to version control. The documentation should clearly highlight the sensitivity of `serviceRoleKey` and recommend secure handling practices. | LLM | SKILL.md:126 |
Scan History
Embed Code
[](https://skillshield.io/report/5cb0632ecad8c589)
Powered by SkillShield