Trust Assessment
taskboardai-skill received a trust score of 74/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Direct command execution via mcp_server, Unpinned dependency in mcp_server command.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Direct command execution via mcp_server The skill manifest specifies a direct command execution using `node` to run a script located at `/opt/homebrew/lib/node_modules/taskboardai/server/mcp/kanbanMcpServer.js`. This allows the skill to execute arbitrary code on the host system. If the `kanbanMcpServer.js` script is compromised or malicious, it could lead to full system compromise. Avoid direct execution of untrusted scripts. If necessary, containerize the execution environment, apply strict sandboxing, or use a trusted, signed version of the script. Ensure the script itself is thoroughly vetted for security vulnerabilities. | LLM | SKILL.md:15 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/hyddd/taskboardai-skill/SKILL.md:1 | |
| MEDIUM | Unpinned dependency in mcp_server command The `mcp_server` command executes a script from a globally installed `node_modules` package (`taskboardai`). There is no version pinning or integrity check specified for this dependency. This makes the skill vulnerable to supply chain attacks if the `taskboardai` package or its dependencies are compromised or updated maliciously. Pin the version of the `taskboardai` package (e.g., by using a specific version in the path or a package manager manifest) and ideally include integrity checks (e.g., checksums). Consider vendoring critical dependencies or running them in isolated environments. | LLM | SKILL.md:18 |
Scan History
Embed Code
[](https://skillshield.io/report/4209b7eee3b095fd)
Powered by SkillShield