Security Audit

look-ahead-scheduler

github.com/openclaw/skills

AI SkillCommit 13146e6a3d46

TRUSTED

Scanned 2 months ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

look-ahead-scheduler received a trust score of 87/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Markdown Injection in Generated Reports.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

93%

Dependency Graph

100%

LLM Behavioral Safety

93%

Behavioral Risk Signals

Dynamic Code

1 finding

Security Findings2

Severity	Finding	Layer	Location
MEDIUM	Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter.	Static	skills/datadrivenconstruction/look-ahead-scheduler/SKILL.md:1
MEDIUM	Markdown Injection in Generated Reports The `generate_look_ahead_report` and `get_constraint_log` methods construct markdown strings using f-strings, directly embedding user-controlled input such as `project_name`, activity names, constraint descriptions, and responsible parties. If these inputs contain markdown formatting characters (e.g., `\|`, `#`, ``, `[`, `]`, `(`, `)`), an attacker could inject arbitrary markdown, potentially manipulating the LLM's subsequent interpretation of the report or causing rendering issues. This is a form of prompt injection if the output is consumed by an LLM without sanitization. Sanitize all user-controlled input before embedding it into markdown strings. This can involve escaping markdown special characters (e.g., `\|`, ``, `_`, `[`, `]`, `(`, `)`, `#`, `+`, `-`, `.`, `!`, `` ` ``) or using a dedicated markdown rendering library that handles escaping. For table cells, ensure that `\|` characters within data are escaped (e.g., `\\|`). Relevant lines include 247, 264, 285, and 300.	LLM	SKILL.md:247

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/431ebdfab48f43a4.svg)](https://skillshield.io/report/431ebdfab48f43a4)