Trust Assessment
prompt-craft received a trust score of 84/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 0 high, 2 medium, and 1 low severity. Key findings include Missing required field: name, Node lockfile missing, Prototype Pollution via JSON.parse in CLI arguments.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/lxgicstudios/prompt-craft/SKILL.md:1 | |
| MEDIUM | Prototype Pollution via JSON.parse in CLI arguments The `cli.js` script uses `JSON.parse()` to interpret values for `--rules` and `--examples` command-line arguments. If a malicious JSON string (e.g., `{"__proto__": {"polluted": true}}`) is passed as an argument, it could lead to prototype pollution. This vulnerability could allow an attacker (or a compromised AI agent) to inject properties into `Object.prototype`, potentially altering the behavior of objects throughout the application and leading to unexpected execution flows or denial of service. Implement robust validation for JSON input before parsing, or use a deep copy mechanism after parsing to prevent prototype pollution. For example, ensure the parsed object adheres to a strict schema, or use `structuredClone()` (Node.js 17+) or a library like `lodash.clonedeep` to create a safe copy. Alternatively, if the input is expected to be a simple array of strings, avoid `JSON.parse` and rely solely on `value.split(',')`. | LLM | cli.js:70 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/lxgicstudios/prompt-craft/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/cf396dfe87c0f545)
Powered by SkillShield