Security Audit
claude-dev-suite/claude-dev-suite:skills/api-design/pagination
github.com/claude-dev-suite/claude-dev-suiteTrust Assessment
claude-dev-suite/claude-dev-suite:skills/api-design/pagination received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Potential Database Order By Injection via User Input.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on March 16, 2026 (commit 8c8434ef). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Potential Database Order By Injection via User Input The code snippets for filtering and sorting in both TypeScript and Java dynamically construct the 'orderBy' clause using user-supplied input (the 'sort' parameter) without explicit validation against a whitelist of allowed column names. This could allow an attacker to inject arbitrary column names, potentially leading to database errors, performance degradation (e.g., sorting on non-indexed columns), or information disclosure (e.g., inferring column existence). While modern ORMs protect against value-based SQL injection, they often do not automatically sanitize column names in dynamic 'orderBy' clauses. Implement a whitelist of allowed column names for sorting. Before using `sort` and `order` in the `orderBy` clause, validate them against a predefined list of safe, sortable fields. For example, `if (!allowedSortFields.includes(sort)) throw new Error('Invalid sort field');` | LLM | SKILL.md:40 | |
| MEDIUM | Potential Database Order By Injection via User Input The Spring Boot code snippet constructs a `Sort` object using user-supplied input (`sort[0]` for the column name) without explicit validation. This allows an attacker to inject arbitrary column names into the `orderBy` clause, which could lead to database errors, performance issues, or information disclosure. While `Sort.Direction.fromString` handles invalid directions, the column name itself is not validated. Implement a whitelist of allowed column names for sorting. Before constructing the `Sort` object, validate `sort[0]` against a predefined list of safe, sortable fields. For example, `if (!allowedSortFields.contains(sort[0])) throw new IllegalArgumentException('Invalid sort field');` | LLM | SKILL.md:62 |
Scan History
Embed Code
[](https://skillshield.io/report/c064c1fa81ebb54b)
Powered by SkillShield