Security Audit

senior-fullstack

github.com/sickn33/antigravity-awesome-skills

AI SkillCommit e36d6fd3b3f6

TRUSTED

Scanned 1 day ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

senior-fullstack received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Arbitrary file write via --output argument.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

100%

Dependency Graph

100%

LLM Behavioral Safety

85%

Behavioral Risk Signals

Filesystem Write

1 finding

Excessive Permissions

1 finding

Security Findings1

Severity	Finding	Layer	Location
HIGH	Arbitrary file write via --output argument The Python scripts (`scripts/code_quality_analyzer.py`, `scripts/fullstack_scaffolder.py`, and `scripts/project_scaffolder.py`) accept an `--output` argument. The value provided to this argument is directly used as a file path to write the script's JSON results. There is no validation or sanitization of this path, allowing an attacker to specify an arbitrary file path on the system. This could lead to overwriting critical system files, writing to sensitive directories, or creating files in unexpected locations, potentially leading to denial of service, privilege escalation, or data exfiltration if sensitive data were to be included in the output in the future. Implement strict validation and sanitization for the `--output` argument. Restrict output paths to a designated, sandboxed directory (e.g., a temporary directory or a specific output folder within the project). Alternatively, if writing to arbitrary paths is intended, ensure that the skill runs with minimal necessary file system permissions and that the content written is always benign and non-executable. Consider using a file dialog or requiring explicit user confirmation for non-standard paths.	LLM	scripts/code_quality_analyzer.py:109

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/88be59c023fe29f6.svg)](https://skillshield.io/report/88be59c023fe29f6)