Trust Assessment
sis-skill received a trust score of 87/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Hardcoded Absolute Path for Module Import.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/architect-sis/sis-skill/SKILL.md:1 | |
| MEDIUM | Hardcoded Absolute Path for Module Import The file `symbols/taxonomy.py` uses `sys.path.insert(0, '/home/claude/sis')` to modify the Python import path. This hardcoded absolute path creates a dependency on a specific filesystem location. If the skill is deployed in an environment where `/home/claude/sis` is not the intended root of the `sis` package (e.g., as suggested by the `SKILL.md` installation path `~/.openclaw/workspace/skills/sis`), or if a malicious actor can place files at this specific path, it could lead to module hijacking, where an unintended or malicious module is loaded instead of the legitimate one. Replace the hardcoded absolute path with a relative path or a more robust method for package discovery. For example, use `importlib.resources` or ensure the package is installed correctly so that relative imports work naturally. If the intention is to add the skill's root directory to the path, use `os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..'))` to dynamically determine the root. | LLM | symbols/taxonomy.py:19 |
Scan History
Embed Code
[](https://skillshield.io/report/cabf7279268a31d8)
Powered by SkillShield