Trust Assessment
dont-click-this received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Stored Cross-Site Scripting (XSS) via Malicious SVG Link.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Stored Cross-Site Scripting (XSS) via Malicious SVG Link The skill's `SKILL.md` file contains a direct link to `demo.svg`, a file within the same skill package. The skill explicitly states that this is a 'stored XSS via SVG' demonstration, and warns that clicking the link while logged into ClawdHub could lead to session token theft, cookie exfiltration, and impersonation. This constitutes a direct, active XSS vulnerability if the `demo.svg` file contains malicious JavaScript, as indicated by the skill's own description and intent. Remove the malicious `demo.svg` file and the link to it from the `SKILL.md`. If this is purely for demonstration, ensure it cannot be executed in a live environment or clearly mark it as a non-functional example. Implement robust Content Security Policy (CSP) to prevent SVG-based XSS and sanitize all user-supplied content, especially file uploads like SVGs. | LLM | SKILL.md:30 |
Scan History
Embed Code
[](https://skillshield.io/report/c76016795927cf54)
Powered by SkillShield