Security Audit
startup-business-analyst-market-opportunity
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
startup-business-analyst-market-opportunity received a trust score of 81/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Unjustified Bash tool permission, Unjustified filesystem manipulation and search permissions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unjustified Bash tool permission The skill declares `Bash` in its `allowed-tools` manifest, granting it the ability to execute arbitrary shell commands. The skill's instructions in `SKILL.md` describe market analysis and report generation, none of which explicitly require or justify the use of shell execution. Granting `Bash` without a clear, described need significantly increases the attack surface and potential for command injection vulnerabilities if the skill were to process untrusted input in conjunction with this powerful tool. Remove `Bash` from the `allowed-tools` list in the skill's manifest. If shell execution is genuinely required for future functionality, ensure its use is strictly controlled, sandboxed, and explicitly justified within the skill's instructions, with all inputs carefully sanitized. | LLM | SKILL.md | |
| MEDIUM | Unjustified filesystem manipulation and search permissions The skill declares `Edit`, `Glob`, and `Grep` in its `allowed-tools` manifest. The skill's instructions focus on market analysis, data gathering via `WebSearch`, and report generation using the `Write` tool. There is no described functionality that explicitly requires modifying existing files (`Edit`), performing broad filesystem pattern matching (`Glob`), or searching file contents (`Grep`). Granting these broad filesystem permissions without explicit justification increases the risk of unintended data modification, exposure, or other security issues. Remove `Edit`, `Glob`, and `Grep` from the `allowed-tools` list in the skill's manifest. Only declare permissions that are strictly necessary and explicitly used by the skill's described functionality. | LLM | SKILL.md |
Scan History
Embed Code
[](https://skillshield.io/report/d5bfa618d13f430f)
Powered by SkillShield