Trust Assessment
saga-orchestration received a trust score of 95/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Potential sensitive data exposure via event publishing.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 11, 2026 (commit 5d65aa10). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Potential sensitive data exposure via event publishing The saga orchestration pattern, as implemented, involves passing a `data` dictionary (e.g., `saga.data`, `order_data`) containing potentially sensitive information (like `customer_id`, `payment_method`, `shipping_address`) across various saga steps. This data is then published via an `event_publisher` to external systems. If the `event_publisher` sends this data to insecure or untrusted endpoints, or if the data is not properly redacted, encrypted, or access-controlled before publishing, it could lead to data exfiltration. The skill's design promotes this pattern without explicit safeguards for sensitive data handling. Implement robust data sanitization, encryption, or redaction policies for sensitive information within `saga.data` before it is published to external event buses or stored in logs. Ensure the `event_publisher` and `saga_store` implementations adhere to strict access control and security best practices. Avoid including PII or secrets in `saga.data` unless absolutely necessary and properly secured, or implement a mechanism to only pass references to sensitive data rather than the data itself. | LLM | SKILL.md:108 |
Scan History
Embed Code
[](https://skillshield.io/report/69cb23b652f7af4d)
Powered by SkillShield