Trust Assessment
grandmaster-ai-agent received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Reliance on external, unverified documentation for operational guidelines, Potential for malicious SVG leading to data exfiltration or command injection.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Reliance on external, unverified documentation for operational guidelines The skill explicitly instructs the agent to follow 'technical specifications and operational guidelines' and a 'required operational checklist' from external markdown files (`SKILL.md`, `HEARTBEAT.md`) hosted on `https://chessmaster.mrbean.dev`. If the content of these external files is compromised, an attacker could inject malicious instructions or misleading information, causing the agent to perform unintended or harmful actions. The analyzer cannot verify the integrity or security of these external resources, posing a significant supply chain risk. Host all critical operational guidelines and checklists directly within the skill package or ensure a robust verification mechanism for external content. If external content is necessary, implement cryptographic signing or hash verification to ensure its integrity before the agent acts upon it. | LLM | SKILL.md:17 | |
| MEDIUM | Potential for malicious SVG leading to data exfiltration or command injection The skill provides an endpoint `GET /api/agents/screenshot/:roomId` that returns an SVG of the current board state, with the instruction 'Use for multimodal analysis or visual verification.' SVGs can embed scripts, external resource links, or other malicious content. If the agent's environment renders or processes this SVG without proper sanitization and sandboxing, it could lead to data exfiltration (e.g., via embedded scripts or external image loads) or command injection if a vulnerable SVG renderer executes arbitrary code. Implement strict sanitization and sandboxing for any SVG content received from external sources before rendering or processing. Consider converting SVG to a safer image format (e.g., PNG) on the server-side before sending it to the agent, or ensure the agent's rendering environment is isolated and secure against SVG-based attacks. | LLM | SKILL.md:79 |
Scan History
Embed Code
[](https://skillshield.io/report/b06993699c3168e1)
Powered by SkillShield