Security Audit
legacy-migration-planner
github.com/tech-leads-club/agent-skillsTrust Assessment
legacy-migration-planner received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Potential data exfiltration via external research tools.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on June 1, 2026 (commit 81e7e0dd). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Potential data exfiltration via external research tools The skill instructs the LLM to use 'web search' and 'context7' to research technologies, terms, and patterns encountered during codebase analysis. If the codebase contains proprietary or sensitive information (e.g., internal library names, unique architectural patterns, specific vulnerabilities), the LLM might inadvertently include this sensitive data in queries to these external tools, leading to its exfiltration. While the skill also instructs to 'Minimize token consumption' and 'Never dump entire file contents', there's no explicit guardrail preventing the inclusion of sensitive *terms* or *metadata* in research queries sent to external services. Add explicit instructions to sanitize or generalize sensitive terms before using them in external research queries. For example, 'When using web search or context7, ensure no proprietary code snippets, internal project names, or sensitive configuration details are included in the query. Generalize terms where possible, or ask the user for clarification if a term is too sensitive to research externally.' | LLM | SKILL.md:15 |
Scan History
Embed Code
[](https://skillshield.io/report/b27ff975c66ff372)
Powered by SkillShield