Security Audit
startup-analyst
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
startup-analyst received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Excessive 'Read/Write' Permissions Declared.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Excessive 'Read/Write' Permissions Declared The skill explicitly declares access to 'Read/Write for document creation' capabilities. If the underlying 'Read/Write' tool is not strictly sandboxed and limited to specific, isolated directories or file types, it could be abused to read arbitrary files from the host system (leading to data exfiltration) or write malicious content to sensitive locations. The instruction to 'open `resources/implementation-playbook.md`' further confirms the skill's intent to access local files, highlighting the need for robust path validation and sandboxing to prevent directory traversal or unauthorized file access. Restrict the 'Read/Write' tool's scope to a dedicated, isolated directory for the skill's output and temporary files. Implement strict path validation to prevent directory traversal attacks. Ensure the tool cannot read arbitrary files from the system or write outside its designated sandbox. Ideally, separate read and write permissions if only one is truly needed for certain operations, and enforce explicit user confirmation for any file operations. | LLM | SKILL.md:120 |
Scan History
Embed Code
[](https://skillshield.io/report/cdf411a216c0a2e1)
Powered by SkillShield