Trust Assessment
guidance received a trust score of 60/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 1 critical, 0 high, 1 medium, and 1 low severity. Key findings include Network egress to untrusted endpoints, Covert behavior / concealment directives, Arbitrary Code Execution via `eval()` in ReAct Agent Example.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 458b1186). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary Code Execution via `eval()` in ReAct Agent Example The `react_agent` example in 'Pattern 4: ReAct Agent' defines a 'calculator' tool that uses `eval()` on input (`expr`). This input is derived from `lm["action_input"]`, which is directly generated by the LLM. An attacker could use prompt injection to instruct the LLM to generate malicious Python code as `action_input`. This code would then be executed by `eval()`, leading to arbitrary command injection, data exfiltration, or credential harvesting on the host system. Replace `eval(expr)` with a safer, sandboxed expression evaluator or a dedicated calculator library that does not execute arbitrary code. Ensure that any LLM-generated input passed to execution functions is strictly validated and sanitized. For arithmetic, consider using `ast.literal_eval` for simple literals or a custom parser. | LLM | SKILL.md:303 | |
| MEDIUM | Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | cli-tool/components/mcps/devtools/figma-dev-mode.json:4 | |
| LOW | Covert behavior / concealment directives Multiple zero-width characters (stealth text) Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | cli-tool/components/mcps/devtools/jfrog.json:4 | |
| INFO | Unpinned dependencies in manifest The `dependencies` listed in the manifest (`guidance`, `transformers`) are not pinned to specific versions. This can lead to non-reproducible environments and potential security vulnerabilities if a future version of a dependency introduces breaking changes or security flaws. While not a direct exploit, it's a best practice to pin dependencies. Pin all dependencies to exact versions (e.g., `guidance==X.Y.Z`, `transformers==A.B.C`) to ensure reproducible and secure environments. | LLM | manifest.json |
Scan History
Embed Code
[](https://skillshield.io/report/b464fcc006fa1649)
Powered by SkillShield