Trust Assessment
qr-factory received a trust score of 88/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Potential Directory Traversal via User-Specified Output Path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/sa9saq/qr-factory/SKILL.md:1 | |
| MEDIUM | Potential Directory Traversal via User-Specified Output Path The skill description indicates that QR codes can be saved to a 'user-specified path'. While the 'Security' section explicitly mentions the need to 'Sanitize file paths to prevent directory traversal,' the capability to specify an arbitrary path without proper validation could lead to writing files to unintended or sensitive locations on the filesystem. This constitutes an excessive permission if not strictly controlled, potentially allowing an attacker to overwrite critical files or write to web-accessible directories. Ensure all user-provided file paths are strictly sanitized to prevent directory traversal. This typically involves resolving the absolute path and verifying that it falls within an allowed, sandboxed directory (e.g., using `os.path.abspath` and `os.path.commonprefix` or a dedicated path sanitization library). Do not allow arbitrary file writes outside of designated safe directories. | LLM | SKILL.md:30 |
Scan History
Embed Code
[](https://skillshield.io/report/240aaf15c81ca2a1)
Powered by SkillShield