Trust Assessment
proactive-tasks received a trust score of 91/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Node lockfile missing, Skill writes to shared workspace directories.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Skill writes to shared workspace directories The skill's `task_manager.py` script defines `WORKSPACE_ROOT` as two levels up from its project root, leading to `MEMORY_DIR` and `SESSION_STATE_FILE` being located in a shared `skills/memory` directory and `skills/SESSION-STATE.md` file, respectively. This means the skill is writing to and reading from directories and files outside its own dedicated skill directory (`skills/imrkhn03/proactive-tasks`). This breaks skill isolation and could lead to data corruption, overwrites, or unintended data leakage if other skills or the main agent also use these shared locations. Modify the `WORKSPACE_ROOT`, `MEMORY_DIR`, and `SESSION_STATE_FILE` definitions to ensure all skill-specific data is stored within the skill's own directory (e.g., `PROJECT_ROOT / 'memory'` and `PROJECT_ROOT / 'SESSION-STATE.md'`). This ensures proper isolation and prevents conflicts with other skills. | LLM | scripts/task_manager.py:21 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/imrkhn03/proactive-tasks/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/75b3492f798f58d7)
Powered by SkillShield