Trust Assessment
DevLog Skill received a trust score of 75/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Sensitive environment variable access: $HOME, Unpinned primary dependency in setup script, Unpinned secondary dependency (pipx) in setup script.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unpinned primary dependency in setup script The `setup.sh` script installs the `dev-log-cli` package using `pipx install dev-log-cli` without specifying a version. This makes the skill vulnerable to supply chain attacks, where a malicious update to the `dev-log-cli` package on PyPI could be automatically installed and executed, leading to arbitrary code execution or other compromises. Pin the version of `dev-log-cli` to a known good version (e.g., `pipx install dev-log-cli==X.Y.Z`). Consider using a `requirements.txt` with hashes for stronger integrity checks if `pipx` supports it, or verify the package source. | LLM | setup.sh:23 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/crimsondevil333333/devlog-skill/setup.sh:12 | |
| MEDIUM | Unpinned secondary dependency (pipx) in setup script The `setup.sh` script installs `pipx` using `python3 -m pip install --user pipx` without specifying a version. While `pipx` is a widely used and generally trusted tool, installing it without a version pin introduces a potential, albeit lower, supply chain risk. A malicious update to `pipx` itself could be installed. Pin the version of `pipx` to a known good version (e.g., `python3 -m pip install --user pipx==X.Y.Z`). | LLM | setup.sh:10 |
Scan History
Embed Code
[](https://skillshield.io/report/e290e32e6f5bc5ec)
Powered by SkillShield