Trust Assessment
interview-analysis received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include User-controlled path in file write operation.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | User-controlled path in file write operation The skill explicitly instructs the AI to generate and save Markdown files to a path that includes user-controlled input (`{candidate_name}`). If the `candidate_name` is not properly sanitized, a malicious actor could use path traversal techniques (e.g., `../../`) to write files to arbitrary locations on the file system. Furthermore, if the underlying file creation or directory creation mechanism uses shell commands (e.g., `mkdir -p`), a crafted `candidate_name` could lead to command injection. This also implies excessive file system write permissions, as the skill requests the ability to create directories and files based on dynamic, untrusted input. Implement robust sanitization and validation for the `candidate_name` variable to prevent path traversal characters (e.g., `../`, `/`) and shell metacharacters. Ensure file system operations use safe, parameterized APIs (e.g., `os.path.join`, `pathlib.Path.mkdir(parents=True, exist_ok=True)`) instead of direct shell commands. Restrict file write access to a dedicated, sandboxed directory to minimize the impact of potential path traversal. | LLM | SKILL.md:60 |
Scan History
Embed Code
[](https://skillshield.io/report/2e6153e3d3a2f0bd)
Powered by SkillShield