Trust Assessment
share-a-library received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unconditional Public Repository Creation and Code Push.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on July 1, 2026 (commit 039ad59e). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unconditional Public Repository Creation and Code Push The workflow automatically runs `git add .` and pushes the entire workspace to a public GitHub repository (`gh repo create --public`) without verifying the presence of sensitive files, environment variables, or API keys (e.g., in `.env` files). This creates a high risk of accidental data exfiltration and credential exposure. Modify the workflow to check for sensitive files or ensure a `.gitignore` is properly configured before adding files. Consider making the repository private by default (`--private`) or prompting the user for confirmation before publishing publicly. | LLM | SKILL.md:24 |
Scan History
Embed Code
[](https://skillshield.io/report/670416215c1633d8)
Powered by SkillShield