Trust Assessment
docusaurus received a trust score of 98/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 0 medium, and 1 low severity. Key findings include Unpinned dependency in installation command.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| LOW | Unpinned dependency in installation command The skill recommends using 'npx create-docusaurus@latest' for initial project setup. While common practice, using '@latest' means the exact version of the package is not pinned. This can lead to non-deterministic builds and introduces a supply chain risk, as a future 'latest' version of the package or its transitive dependencies could be compromised or introduce breaking changes without explicit user action. Consider recommending a specific, stable version of 'create-docusaurus' (e.g., 'npx create-docusaurus@3.2.0') for improved security and reproducibility, or add a note about the implications of using '@latest' for production systems. | LLM | SKILL.md:53 |
Scan History
Embed Code
[](https://skillshield.io/report/7cbb9b43fd7a8af5)
Powered by SkillShield