Security Audit
NetSuite Automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
NetSuite Automation received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Arbitrary SuiteQL Query Execution via NETSUITE_RUN_SUITEQL_QUERY.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit 27904475). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary SuiteQL Query Execution via NETSUITE_RUN_SUITEQL_QUERY The `NETSUITE_RUN_SUITEQL_QUERY` tool allows the execution of arbitrary SuiteQL SELECT statements via the `q` parameter. This grants an LLM (or a malicious prompt interacting with the LLM) the ability to perform direct database queries, bypassing higher-level API abstractions. This can lead to:
1. **Data Exfiltration**: An attacker could craft queries to extract sensitive information from any table accessible by the NetSuite integration user (e.g., customer data, financial records, employee information).
2. **Command Injection (SQL)**: Direct database query access increases the attack surface for SQL injection vulnerabilities if the underlying implementation doesn't properly sanitize all possible inputs, potentially allowing data manipulation or unauthorized access.
3. **Excessive Permissions**: Granting an LLM the ability to run arbitrary SQL queries is a very broad permission, potentially bypassing fine-grained access controls that might be present in more specific API tools. 1. **Restrict `NETSUITE_RUN_SUITEQL_QUERY`**: If possible, remove or severely restrict this tool. Prefer specific, purpose-built API tools over generic SQL query execution. 2. **Implement Allow-listing**: If direct query access is absolutely necessary, implement a strict allow-list of permitted tables, columns, and query patterns. 3. **Least Privilege**: Ensure the NetSuite integration user associated with this skill has the absolute minimum necessary permissions to perform its intended functions. 4. **Input Validation/Sanitization**: Implement robust server-side validation and sanitization for the `q` parameter to prevent malicious SQL constructs. 5. **Audit Logging**: Log all SuiteQL queries executed through this tool for auditing and anomaly detection. | LLM | SKILL.md:52 |
Scan History
Embed Code
[](https://skillshield.io/report/4b5cc0c864d9f10e)
Powered by SkillShield