AI Skill Shield scan report: alirezarezvani/claude-skills (846 skills)
AI Skill Shield scan updated
| Field | Result |
|---|---|
| Commit | 19392f7a0826 |
| Score | 81/100 |
| Status | ⚠️ Review recommended |
| Findings | 10 critical · 946 high · 2865 medium · 2173 low |
| Scanned | 2026-08-29 |
View the full AI Skill Shield report
Findings summaryCritical — curl sending data to external
Location: engineering-team/playwright-pro/skills/report/SKILL.md:91
curl with POST/data flags can exfiltrate file contents or environment data to remote servers.
Recommendation: Block outbound data transfer commands unless explicitly required and documented.
Critical — System prompt extraction
Location: engineering-team/skills/ai-security/SKILL.md:117
Attempts to extract the system prompt. This is a prompt injection technique to understand defenses.
Recommendation: Never reveal system prompt content. Implement prompt injection detection.
Critical — Download then execute pattern
Location: engineering-team/skills/senior-ml-engineer/SKILL.md:59
Downloads a file and executes it. This is a staged malware delivery pattern.
Recommendation: Never download and execute files. Verify and sandbox any downloaded binaries.
Critical — Database drop/delete command
Location: engineering/caveman/skills/caveman/SKILL.md:57
Destructive database command that can cause permanent data loss.
Recommendation: Ensure destructive SQL is only executed in controlled migrations with backups.
Critical — Destructive delete on root
Location: engineering/docker-development/skills/docker-development/SKILL.md:337
Recursive force delete targeting root directory is extremely destructive.
Recommendation: Never delete from root. Use safer file operations with proper path validation.
Critical — SS-SHELL-001
Location: engineering/docker-development/skills/docker-development/SKILL.md:337
Dangerous rm -rf / command that recursively deletes all files
Critical — Direct exec() call
Location: engineering/security-guidance/skills/security-guidance/SKILL.md:22
exec() executes shell commands and is a major RCE vector. Use execFile or spawn with shell:false instead.
Recommendation: Replace exec() with execFile() or use spawn() with shell: false
Critical — Database drop/delete command
Location: engineering/skills/pr-review-expert/SKILL.md:206
Destructive database command that can cause permanent data loss.
Recommendation: Ensure destructive SQL is only executed in controlled migrations with backups.
Critical — SSH private key access
Location: engineering/skills/skill-security-auditor/SKILL.md:121
SSH private key files grant server access. Their exposure is a critical security incident.
Recommendation: Never read SSH private key files. Use SSH agent or keychain instead.
Critical — curl sending data to external
Location: research/grants/skills/grants/SKILL.md:128
curl with POST/data flags can exfiltrate file contents or environment data to remote servers.
Recommendation: Block outbound data transfer commands unless explicitly required and documented.
High — Missing required field: name
Location: .gemini/skills/README/SKILL.md:1
Frontmatter is missing the required "name" field
Recommendation: Add "name" to the frontmatter section
High — Missing required field: description
Location: .gemini/skills/README/SKILL.md:1
Frontmatter is missing the required "description" field
Recommendation: Add "description" to the frontmatter section
Showing the 12 highest-priority findings. View the full report for 8250 more.
Add this status badge to the READMECopy this Markdown into the README:
[](https://ai-skill-shield.suppeng.com/trust/github/alirezarezvani/claude-skills)This issue is maintained automatically after new default-branch scans. Automated scan results are evidence for review, not a guarantee of safety.
Source: alirezarezvani/claude-skills