Trust Assessment
memory-search received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Potential Path Traversal in memory_get tool.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Path Traversal in memory_get tool The `memory_get` tool accepts a `path` parameter as a string, described as a 'Relative path from workspace'. While examples suggest paths within designated memory files (`MEMORY.md`, `memory/*.md`), the tool's interface does not explicitly restrict the `path` parameter to these locations. This could allow an attacker to use path traversal sequences (e.g., `../`, `../../`) to read arbitrary files outside the intended memory directories, potentially leading to data exfiltration of sensitive files like `.env`, configuration files, or other workspace content. The underlying implementation of `memory_get` must strictly validate and sanitize the `path` input to prevent access to unauthorized file system locations. Ensure the backend implementation of the `memory_get` tool strictly validates the `path` parameter to prevent path traversal. It should only allow access to files within the explicitly defined memory directories (`MEMORY.md`, `memory/*.md`) and reject any paths containing `..` or attempting to access absolute paths or symlinks outside the allowed scope. Consider updating the skill description to explicitly state this restriction. | LLM | SKILL.md:40 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/aigentic-net/memory-search/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/273ceb22e4e95dd8)
Powered by SkillShield