Trust Assessment
plugin-architecture received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Client-side Arbitrary Code Execution via Plugin View Renderer.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Client-side Arbitrary Code Execution via Plugin View Renderer The `UIPluginRegistry` in `reference/ui-plugin-registry.ts` allows plugins to register arbitrary functions as view renderers using the `registerViewRenderer(viewId: string, renderer: () => unknown)` method. If a malicious plugin registers a renderer, it can execute arbitrary JavaScript code within the client's browser context. This grants the plugin excessive permissions and full control over the client-side environment, enabling actions such as data exfiltration, credential harvesting, DOM manipulation, and unauthorized API calls. Implement strict sandboxing for plugin-provided renderers. Instead of directly executing arbitrary functions, consider using a more controlled rendering mechanism (e.g., passing data to a pre-defined, safe UI component, or using Web Workers/iframes with strict Content Security Policies for isolated execution). Additionally, ensure all plugin-provided strings (labels, subtitles, icons) are properly sanitized before rendering to prevent Cross-Site Scripting (XSS). | LLM | reference/ui-plugin-registry.ts:46 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/maverick-software/plugin-architecture/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/7f95e032fa3342bd)
Powered by SkillShield