Trust Assessment
dtek-light-check received a trust score of 45/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 5 findings: 1 critical, 1 high, 1 medium, and 1 low severity. Key findings include File read + network send exfiltration, Sensitive path access: AI agent config, Unpinned npm dependency version.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Manifest | skills/kapishdima/dtek-light/SKILL.md:29 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.claude/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | skills/kapishdima/dtek-light/SKILL.md:29 | |
| MEDIUM | Unpinned npm dependency version Dependency 'playwright' is not pinned to an exact version ('^1.50.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/kapishdima/dtek-light/package.json | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/kapishdima/dtek-light/package.json | |
| INFO | Unpinned Dependency Version The 'playwright' dependency in package.json uses a caret (^) version specifier, allowing minor and patch updates. While common, this introduces a slight supply chain risk as a malicious or vulnerable update within the specified range could be installed without explicit review. For enhanced security, consider pinning to exact versions. Pin the 'playwright' dependency to an exact version (e.g., "1.50.0") to ensure deterministic builds and prevent unexpected updates. Regularly audit and manually update dependencies. | LLM | package.json:10 |
Scan History
Embed Code
[](https://skillshield.io/report/43acb8cca4d4599a)
Powered by SkillShield