Trust Assessment
markdown-to-social received a trust score of 88/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Output directory path traversal.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/hugosbl/markdown-to-social/SKILL.md:1 | |
| MEDIUM | Output directory path traversal The skill allows users to specify an output directory via the `--output DIR` argument. If the `scripts/md2social.py` script does not sanitize this input, an attacker could use path traversal sequences (e.g., `../`) to write files to arbitrary locations on the filesystem outside the intended skill directory. This could lead to unauthorized file creation or modification in sensitive system areas. Sanitize the `--output DIR` argument in `scripts/md2social.py` to prevent path traversal. This can be achieved by resolving the path to an absolute path and then ensuring it is within an allowed base directory, or by strictly validating path components. For example, use `os.path.abspath()` and then check if the resolved path starts with a trusted base directory, or use `pathlib.Path.resolve()` with `strict=True` and validate the parent directory. | LLM | scripts/md2social.py |
Scan History
Embed Code
[](https://skillshield.io/report/b8c02f928bc821a0)
Powered by SkillShield