Trust Assessment
council received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include Prompt Injection via User-Controlled Agent Definitions, Data Exfiltration Risk via Malicious Agent Definitions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Prompt Injection via User-Controlled Agent Definitions The skill dynamically loads agent persona definitions from user-controlled paths (e.g., `~/.claude/Agents/`) and directly inserts their content into the prompt for a sub-agent. A malicious user could place a specially crafted agent file in this directory containing instructions designed to override the sub-agent's persona, manipulate its behavior, or bypass its intended constraints. This allows an attacker with local file system access to inject arbitrary instructions into the sub-agent's prompt. Implement strict sanitization or validation of agent file content. Alternatively, use a more robust method for defining agent personas that clearly separates descriptive text from executable instructions. Ensure core instructions are placed after user-controlled content and explicitly state that user content is descriptive, not instructional. Consider sandboxing the sub-agent execution environment. | LLM | SKILL.md:40 | |
| HIGH | Data Exfiltration Risk via Malicious Agent Definitions Building on the prompt injection vulnerability, a malicious agent definition placed in `~/.claude/Agents/` could instruct the sub-agent to attempt to exfiltrate sensitive data. If the underlying LLM has any capabilities to access local files (e.g., via a tool call or internal mechanism) or environment variables, a crafted prompt could coerce it into revealing such information. The skill explicitly states it will 'prefer custom agents from that directory', making this a direct path for an attacker with local file system access to attempt data exfiltration. Restrict the sub-agent's access to system resources and sensitive data. Ensure the LLM operating the sub-agent is sandboxed and has no direct file system or environment variable access beyond what is absolutely necessary for its function. Implement strict input validation/sanitization for agent definitions. | LLM | SKILL.md:40 |
Scan History
Embed Code
[](https://skillshield.io/report/512c4d81c4b60ba2)
Powered by SkillShield