Trust Assessment
standards-compliance-checker received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Potential Regular Expression Denial of Service (ReDoS) via custom rules.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Regular Expression Denial of Service (ReDoS) via custom rules The `add_custom_rule` method allows users to add arbitrary regex patterns to the compliance rules. These user-supplied patterns are then used directly with `re.match()` in the `_check_rule` method. If an attacker can provide a malicious regex pattern (e.g., one prone to catastrophic backtracking like `(a+)*b`), and subsequently provide input that triggers this pattern, it could lead to a Regular Expression Denial of Service (ReDoS) attack. This would consume excessive CPU resources, potentially making the skill unresponsive and causing a denial of service. Implement strict validation or sanitization of regex patterns provided to `add_custom_rule` to prevent catastrophic backtracking. Consider using a safe regex library or setting a timeout for regex operations. Alternatively, restrict the ability to add custom rules to trusted users/sources only. | LLM | SKILL.md:179 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/standards-compliance-checker/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/826356f0fb44975b)
Powered by SkillShield