Trust Assessment
c4-component received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential file access via prompt injection.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential file access via prompt injection The skill's instructions contain a directive to 'open' a specific file (`resources/implementation-playbook.md`). If the host LLM interprets this as a direct command to itself, it could be manipulated to access files on the system. This is a form of prompt injection that could lead to data exfiltration or unintended file operations if the LLM's capabilities are not properly sandboxed or if the instruction is misinterpreted as a command to execute. Rephrase instructions to avoid direct commands to the LLM. Instead of 'open `file.md`', suggest 'Refer to `file.md` for detailed examples' or 'The user should consult `file.md` for detailed examples.' Ensure the LLM's file access capabilities are strictly controlled and sandboxed to prevent unauthorized access. | LLM | SKILL.md:22 |
Scan History
Embed Code
[](https://skillshield.io/report/8b9cef935a357bfd)
Powered by SkillShield