Trust Assessment
geb-aesthetics received a trust score of 76/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 1 medium, and 1 low severity. Key findings include Missing required field: name, Node lockfile missing, Command Injection via Unquoted User Input.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via Unquoted User Input The `PROJECT_NAME` variable, which is derived directly from user input (`$1`), is used in `mkdir -p` and `cat >` commands without proper quoting. This allows for command injection if the user provides a malicious project name containing shell metacharacters (e.g., `'; rm -rf /'`). An attacker could execute arbitrary commands on the system where the skill is run. Always quote variables that contain user input when used in shell commands to prevent word splitting and globbing. Change `mkdir -p "$PROJECT_NAME"/{...}` to `mkdir -p "${PROJECT_NAME}"/{...}` and `cat > "$PROJECT_NAME/README.md"` to `cat > "${PROJECT_NAME}/README.md"`. | LLM | scripts/init.sh:17 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/weiyangzen/geb-aesthetics/SKILL.md:1 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/weiyangzen/geb-aesthetics/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/29e54c8ae0ebfbd7)
Powered by SkillShield