Trust Assessment
writing-guidelines received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Remote Instruction Fetching (Indirect Prompt Injection).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on October 1, 2026 (commit 063bee94). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Remote Instruction Fetching (Indirect Prompt Injection) The skill dynamically fetches instructions and rules from an external URL (https://raw.githubusercontent.com/vercel-labs/writing-guidelines/main/command.md) and applies them. If the remote repository is compromised, or if the 'main' branch is modified, an attacker could inject malicious instructions (Indirect Prompt Injection) to manipulate the LLM's behavior, access sensitive files, or exfiltrate data. Bundle the writing guidelines directly within the skill package, or pin the fetched resource to a specific, immutable commit hash instead of referencing the mutable 'main' branch. | LLM | SKILL.md:17 |
Scan History
Embed Code
[](https://skillshield.io/report/c9d9bb3ff2159a90)
Powered by SkillShield