Trust Assessment
coda-automation received a trust score of 73/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include Skill exposes ability to grant Coda document permissions, Skill exposes ability to publish Coda documents publicly.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Skill exposes ability to grant Coda document permissions The skill provides the `CODA_ADD_PERMISSION` tool, which allows the AI agent to grant `readonly`, `write`, or `comment` access to Coda documents to specified users or email addresses. If the agent is compromised or given malicious instructions, it could be used to grant unauthorized access to sensitive Coda documents, leading to data breaches or unauthorized modifications. Implement strict access controls and approval workflows for agent actions involving `CODA_ADD_PERMISSION`. Ensure the agent's scope of access to Coda is minimized to only what is necessary. Consider human-in-the-loop verification for sensitive operations like granting permissions. | LLM | SKILL.md:160 | |
| HIGH | Skill exposes ability to publish Coda documents publicly The skill provides the `CODA_PUBLISH_DOC` tool, which allows the AI agent to make a Coda document publicly accessible via a link. If the agent is compromised or given malicious instructions, it could be used to inadvertently or maliciously publish sensitive internal documents, leading to a data leak. Implement strict access controls and approval workflows for agent actions involving `CODA_PUBLISH_DOC`. Ensure the agent's scope of access to Coda is minimized. Consider human-in-the-loop verification for sensitive operations like publishing documents. | LLM | SKILL.md:180 |
Scan History
Embed Code
[](https://skillshield.io/report/4dc206ac63eda23f)
Powered by SkillShield