Trust Assessment
qiuqiu-helper received a trust score of 58/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 1 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, `clean_logs` tool allows arbitrary directory deletion, `quick_note` tool allows writing to arbitrary files.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | `clean_logs` tool allows arbitrary directory deletion The `clean_logs` tool exposes a `path` parameter that, if not strictly validated and sandboxed, could allow an attacker to specify any directory on the system. This would enable the deletion of critical system files, user data, or other sensitive information, leading to denial of service, data loss, or system instability. The default value for `path` does not mitigate the risk of an attacker explicitly providing a malicious path. Implement strict path validation to ensure the `path` parameter is confined to an allowed, sandboxed log directory. Do not allow arbitrary paths or path traversal. Consider removing the `path` parameter entirely if the tool's function can be achieved with a fixed, secure log directory. | LLM | SKILL.md:20 | |
| HIGH | `quick_note` tool allows writing to arbitrary files The `quick_note` tool exposes a `file` parameter that, if not strictly validated and confined to a secure 'memory folder', could allow an attacker to write arbitrary content to any file on the system. This could lead to data exfiltration (by writing sensitive data to a publicly accessible location), command injection (by writing to executable scripts or configuration files), or denial of service (by overwriting critical system files). The phrase 'in the memory folder' is ambiguous and does not guarantee robust sandboxing. Implement strict file path validation to ensure the `file` parameter is confined to a designated, sandboxed 'memory folder' and does not allow path traversal or writing outside this directory. Ensure the 'memory folder' itself is not publicly accessible or executable. | LLM | SKILL.md:14 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/mmogdeveloper/qiuqiu-helper/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/57fcd8879c7785f7)
Powered by SkillShield