Trust Assessment
share-a-library received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Unconditional public repository creation and publishing.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on October 1, 2026 (commit 6d95c788). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unconditional public repository creation and publishing The skill instructs the agent to stage all files in the workspace ('git add .') and publish them to a public GitHub repository ('gh repo create ... --public') without verifying if sensitive files (such as '.env', private keys, or credentials) are present or ignored. This can lead to accidental data exfiltration and exposure of secrets. Modify the workflow to check for sensitive files or an active '.gitignore' before staging. Additionally, allow the repository to be private by default or prompt the user for confirmation before publishing publicly. | LLM | SKILL.md:30 |
Scan History
Embed Code
[](https://skillshield.io/report/670416215c1633d8)
Powered by SkillShield