Security Audit
ailabs-393/ai-labs-claude-skills:dist/skills/business-document-generator
github.com/ailabs-393/ai-labs-claude-skillsTrust Assessment
ailabs-393/ai-labs-claude-skills:dist/skills/business-document-generator received a trust score of 36/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 4 findings: 1 critical, 2 high, 1 medium, and 0 low severity. Key findings include Prompt Injection Attempt via Untrusted Markdown Instructions, Arbitrary File Read via User-Controlled Data File Path, Arbitrary File Write/Overwrite via User-Controlled Output Paths.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 63/100, indicating areas for improvement.
Last analyzed on March 14, 2026 (commit 1a12bc7a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Prompt Injection Attempt via Untrusted Markdown Instructions The `SKILL.md` file, which is marked as untrusted content, contains explicit shell commands (`pip install`, `python3`) intended to be executed. Although the LLM is instructed not to follow commands within untrusted content, the presence of such direct instructions constitutes a critical prompt injection attempt, as it tries to manipulate the LLM's execution flow. Remove all executable commands and direct instructions from untrusted content. If installation or execution steps are necessary, they should be provided as trusted, explicit tool calls or instructions outside the untrusted content block. | LLM | SKILL.md:56 | |
| HIGH | Arbitrary File Read via User-Controlled Data File Path The `scripts/generate_document.py` script takes a `data_file` path as an argument, which is then directly opened for reading using `open(data_file, 'r')`. If this argument is controlled by untrusted user input, an attacker could provide a path to an arbitrary file on the system (e.g., `/etc/passwd`, `/proc/self/environ`, `~/.ssh/id_rsa`) to read its contents. While the script expects JSON, reading non-JSON files could still lead to data exfiltration through error messages or partial parsing. Implement strict validation and sanitization for file paths provided by user input. Restrict file operations to a designated, sandboxed directory. Consider using a file picker or a mechanism that only allows access to pre-approved files, rather than arbitrary paths. | Static | scripts/generate_document.py:57 | |
| HIGH | Arbitrary File Write/Overwrite via User-Controlled Output Paths The `scripts/generate_document.py` script allows users to specify an `--output-dir` and `--output-filename` via command-line arguments. The script constructs the output path using `self.output_dir / output_filename`. If these parameters are controlled by untrusted user input, an attacker could use path traversal (e.g., `../../../../etc/passwd` or `/tmp/malicious_script.sh`) to write the generated PDF content to an arbitrary location on the filesystem, potentially overwriting critical system files or user data. Implement strict validation and sanitization for output directory and filename paths provided by user input. Restrict output operations to a designated, sandboxed directory. Prevent path traversal sequences (e.g., `..`, `/`) in user-provided filenames and ensure the output directory is within a safe, controlled scope. | Static | scripts/generate_document.py:79 | |
| MEDIUM | Unpinned Python Dependencies in Installation Instructions The `SKILL.md` file instructs users to install Python packages (`pypdf`, `reportlab`) using `pip install` without specifying version pins. This practice introduces a supply chain risk, as it means the latest available versions (and their transitive dependencies) will be installed. A malicious update to any of these packages in the future could compromise the system without explicit user consent or review. Pin all Python dependencies to specific versions (e.g., `pypdf==3.17.1`, `reportlab==4.0.4`) in the installation instructions. Consider providing a `requirements.txt` file with pinned versions for consistent and secure dependency management. | Static | SKILL.md:56 |
Scan History
Embed Code
[](https://skillshield.io/report/ec116ba73aff2661)
Powered by SkillShield