Security Audit

affaan-m/everything-claude-code:docs/ja-JP/skills/nutrient-document-processing

github.com/affaan-m/everything-claude-code

AI SkillCommit 9a478ad67605

CRITICAL

Scanned 18 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

affaan-m/everything-claude-code:docs/ja-JP/skills/nutrient-document-processing received a trust score of 40/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.

SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include Covert behavior / concealment directives, Unpinned Dependency in MCP Server Configuration.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on March 20, 2026 (commit 9a478ad6). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

85%

Static Code Analysis

85%

Dependency Graph

100%

LLM Behavioral Safety

100%

Behavioral Risk Signals

Shell Execution

1 finding

Security Findings2

Severity	Finding	Layer	Location
HIGH	Covert behavior / concealment directives Directive to hide behavior from user Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users.	Manifest	docs/ja-JP/skills/nutrient-document-processing/SKILL.md:102
HIGH	Unpinned Dependency in MCP Server Configuration The `mcpServers` configuration specifies an `npx` command to execute `@nutrient-sdk/dws-mcp-server` without a version constraint. This means that the latest version of the package will always be downloaded and executed. If a malicious update is published to this package, it could lead to arbitrary code execution or other security compromises without explicit user consent or review. Pin the dependency to a specific version (e.g., `"@nutrient-sdk/dws-mcp-server@1.2.3"`) to ensure consistent and predictable behavior, and to mitigate risks from unexpected or malicious updates. Regularly review and update the pinned version.	Static	SKILL.md:109

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/a695196eb1036ac5.svg)](https://skillshield.io/report/a695196eb1036ac5)