Trust Assessment
harvest-time-reporting-api received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Broad API Access via Harvest Token.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Broad API Access via Harvest Token The skill documents and thus enables access to a wide range of Harvest API endpoints, including creation, update, and deletion operations for critical resources such as time entries, projects, tasks, clients, contacts, users, invoices, and expenses. If the `HARVEST_ACCESS_TOKEN` provided to the AI agent has broad administrative privileges, the agent could perform highly destructive actions (e.g., deleting all projects or users) or access sensitive financial and time tracking data across the entire Harvest account. The skill itself does not implement granular permission controls or least-privilege principles, relying solely on the scope of the provided API token. Implement granular access control within the skill's logic or ensure that the `HARVEST_ACCESS_TOKEN` used by the AI agent is scoped to the absolute minimum necessary permissions (least privilege) in the Harvest application. Consider breaking down the skill into smaller, more specialized skills with limited functionality to reduce the blast radius of a potential misuse. | LLM | skill.md:30 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/zachgodsell93/harvest-time-reporting-api/skill.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/52b25687bc09b762)
Powered by SkillShield