Security Audit
SharePoint Automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
SharePoint Automation received a trust score of 90/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Potential Data Exfiltration via Unrestricted Query Parameters, Potential for Unauthorized SharePoint Resource Creation.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Potential Data Exfiltration via Unrestricted Query Parameters The skill exposes several tools (`SHARE_POINT_LIST_ALL_LISTS`, `SHARE_POINT_SEARCH_QUERY`, `ONE_DRIVE_LIST_SHAREPOINT_LIST_ITEMS_DELTA`, `SHARE_POINT_LIST_FILES_IN_FOLDER`) that accept flexible query parameters such as `filter`, `select`, `orderby`, `querytext`, and `expand`. If the LLM constructs these parameters directly from untrusted user input without proper validation or sanitization, an attacker could craft malicious inputs to broaden the scope of data retrieval, access sensitive fields, or bypass intended access restrictions, leading to unauthorized data exfiltration. Implement strict input validation and sanitization for all user-provided values passed to query parameters like `filter`, `select`, `orderby`, `querytext`, and `expand`. The LLM should confirm sensitive queries with the user before execution. Consider whitelisting allowed values or patterns for these parameters where possible. For `querytext`, ensure the LLM understands the potential for broad searches and prompts for explicit confirmation for sensitive terms. | LLM | SKILL.md:106 | |
| MEDIUM | Potential for Unauthorized SharePoint Resource Creation The skill provides tools such as `SHARE_POINT_SHAREPOINT_CREATE_LIST` and `SHARE_POINT_SHAREPOINT_CREATE_FOLDER`. If the LLM is prompted by untrusted user input to create resources (e.g., lists, folders) without proper validation or confirmation, an attacker could cause the creation of unwanted or malicious resources on the SharePoint site. This could lead to resource exhaustion, organizational confusion, or facilitate further attacks (e.g., creating folders for phishing content). Implement strict input validation for resource names and types. The LLM should always confirm with the user before creating new resources, especially if the names or descriptions appear unusual or potentially malicious. Consider whitelisting allowed templates or enforcing naming conventions. | LLM | SKILL.md:60 |
Scan History
Embed Code
[](https://skillshield.io/report/d5d22418ef2f3675)
Powered by SkillShield