Trust Assessment
legal-docs-fr received a trust score of 87/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, HTML Injection in Generated Documents.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/hugosbl/legal-docs-fr/SKILL.md:1 | |
| MEDIUM | HTML Injection in Generated Documents The skill generates HTML documents by directly embedding user-provided arguments (e.g., client name, address, mission description, tribunal, mediator, etc.) into the HTML structure without proper escaping. This allows for HTML injection, including potential self-XSS, if a malicious user provides HTML tags or script code as input to the command-line arguments. When the generated HTML file is opened locally, these injected elements will be rendered by the browser. While this primarily affects the user running the skill (self-XSS), it could be used to display misleading information or, in specific browser/agent contexts, execute client-side scripts. Sanitize or escape all user-provided input before embedding it into HTML strings. For Python, the `html.escape()` function from the `html` module can be used to convert special characters like `<`, `>`, `&`, and `"` to their HTML-safe equivalents. | LLM | scripts/legal.py:109 |
Scan History
Embed Code
[](https://skillshield.io/report/e4ef7cef6715c82f)
Powered by SkillShield