Trust Assessment
web-deploy-github received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Sensitive environment variable access: $GITHUB_USERNAME, Public exposure of project directory contents.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Public exposure of project directory contents The `deploy_github_pages.sh` script pushes the entire contents of the user-specified project directory (`$PROJECT_NAME`) to a *public* GitHub repository. The command `gh repo create ... --source=. --push` (or `git add .` followed by `git push`) will stage and commit all files in the current directory. If sensitive files (e.g., API keys, `.env` files, personal data) are accidentally placed or generated into this directory before deployment, they will be publicly exposed on GitHub Pages. The skill's workflow encourages the LLM to generate content into this directory, increasing the risk of accidental exposure. 1. **User Warning:** Add explicit warnings in the skill's documentation and output messages about the public nature of GitHub Pages and the risk of exposing sensitive data. Advise users not to place any sensitive information in the project directory. 2. **Sensitive File Exclusion:** Implement a default `.gitignore` file in the `init_project.sh` script that excludes common sensitive file patterns (e.g., `.env`, `*.key`, `config.js` if it's known to contain secrets). 3. **Review/Confirmation Step:** Consider adding a step where the user is prompted to review the files being pushed before final deployment, especially if the LLM generated content. | LLM | scripts/deploy_github_pages.sh:30 | |
| MEDIUM | Sensitive environment variable access: $GITHUB_USERNAME Access to sensitive environment variable '$GITHUB_USERNAME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/kjaylee/kj-web-deploy-github/scripts/deploy_github_pages.sh:9 |
Scan History
Embed Code
[](https://skillshield.io/report/835e115eea372d9a)
Powered by SkillShield