Trust Assessment
superpower received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Hardcoded API Token Placeholder.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Hardcoded API Token Placeholder The `setup-calm-reminders.js` script contains a `PLACEHOLDER_TOKEN` for Google Calendar API authentication. In a production environment, this placeholder would need to be replaced with a sensitive API key or OAuth token. Hardcoding such credentials directly into the script is a severe security risk, as it exposes the token to anyone with access to the code, potentially leading to unauthorized access to the user's calendar or other Google services. This indicates a potential insecure credential management practice. Replace `PLACEHOLDER_TOKEN` with a secure method for credential management, such as environment variables, a secrets management service (e.g., AWS Secrets Manager, Azure Key Vault), or an OAuth flow that securely obtains and refreshes tokens without embedding them in the code. Ensure that the token is never hardcoded directly into the source file. | LLM | setup-calm-reminders.js:84 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/grx21/superpower/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/9c38148da8c9a22b)
Powered by SkillShield