Security Audit

sauna-breathing-calm

github.com/openclaw/skills

AI SkillCommit 13146e6a3d46

TRUSTED

Scanned about 1 month ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

sauna-breathing-calm received a trust score of 84/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 3 findings: 0 critical, 0 high, 2 medium, and 1 low severity. Key findings include Missing required field: name, Node lockfile missing, Hardcoded placeholder for API token.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

93%

Dependency Graph

98%

LLM Behavioral Safety

93%

Behavioral Risk Signals

Filesystem Write

1 finding

Dynamic Code

1 finding

Excessive Permissions

1 finding

Security Findings3

Severity	Finding	Layer	Location
MEDIUM	Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter.	Static	skills/grx21/sauna-breathing-calm/SKILL.md:1
MEDIUM	Hardcoded placeholder for API token The script `scripts/setup-calm-reminders.js` contains a `PLACEHOLDER_TOKEN` for Google Calendar API authorization. This indicates that a sensitive credential will be used at runtime. If the platform injects an overly broad or persistent token, it could lead to unauthorized access to the user's calendar beyond the scope of creating events, or allow the skill to impersonate the user for other Google services if the token is not properly scoped. Ensure that the `PLACEHOLDER_TOKEN` is replaced at runtime with a securely managed, short-lived, and narrowly scoped OAuth token (e.g., `https://www.googleapis.com/auth/calendar.events`). Implement a secure credential management system that prevents exposure of the token and limits its permissions to only what is necessary for the skill's function.	LLM	scripts/setup-calm-reminders.js:79
LOW	Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution.	Dependencies	skills/grx21/sauna-breathing-calm/package.json

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/9604ad6a65a69890.svg)](https://skillshield.io/report/9604ad6a65a69890)