Commercialsales

================================================================================

🔵 VERDICT: LOW

This skill is primarily documentation-based, defining workflows and providing guidance. The main security finding is the presence of a shell command (ls) within the SKILL.md file. While this demonstrates the capability for command execution, its specific use case (listing files in a local, expected directory) is not immediately malicious. The skill also uses read commands to load other local skill definitions and documentation, which is an expected mechanism for skill integration and not considered a direct threat in this context.

Total Findings: 2

🔵 LOW Findings: • Command Execution

• SKILL.md: Line 303: ls ~/.claude/skills/Commercialsales/templates/

ℹ️ INFO Findings: • Local File Access (Skill Integration)

• SKILL.md: Line 240: read ~/.claude/skills/Quoteestimator/SKILL.md • Local File Access (Skill Integration)
• SKILL.md: Line 246: read ~/.claude/skills/Apqpppap/SKILL.md • Local File Access (Skill Integration)
• SKILL.md: Line 252: read ~/.claude/skills/Eightd/SKILL.md • Local File Access (Skill Integration)
• SKILL.md: Line 258: read ~/.claude/skills/Supplychain/SKILL.md • Local File Access (Documentation)
• SKILL.md: Line 300: read ~/.claude/skills/Commercialsales/CLAUDE.md • Local File Access (Documentation)
• SKILL.md: Line 306: read ~/.claude/skills/Commercialsales/reference/contract-review.md • Local File Access (Documentation)
• SKILL.md: Line 309: read ~/.claude/skills/Commercialsales/reference/customer-portals.md

================================================================================