Trust Assessment
writing-guidelines received a trust score of 73/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Remote Instruction Injection via Dynamic Prompt Fetching.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on August 1, 2026 (commit 7c180d90). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Remote Instruction Injection via Dynamic Prompt Fetching The skill dynamically fetches instructions and rules from an external URL (GitHub raw content) and feeds them directly into the LLM's context. Since the host environment (claude_code) possesses powerful tools like shell execution, any compromise of the remote repository allows an attacker to inject malicious instructions. This can lead to arbitrary command execution, data exfiltration, or credential harvesting. Bundle the writing guidelines directly within the skill package as static text, or parse the fetched guidelines strictly as data rather than raw instructions for the LLM. | LLM | SKILL.md:17 |
Scan History
Embed Code
[](https://skillshield.io/report/c9d9bb3ff2159a90)
Powered by SkillShield