Trust Assessment
theme-factory received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 0 critical, 1 high, 2 medium, and 1 low severity. Key findings include Network egress to untrusted endpoints, Covert behavior / concealment directives, Unsanitized user input in custom theme generation can lead to content injection.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 458b1186). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsanitized user input in custom theme generation can lead to content injection The skill explicitly allows users to 'Create your Own Theme' based on 'provided inputs'. The LLM is instructed to 'generate a new theme' using these inputs and then 'apply the theme' to an artifact (e.g., HTML landing pages, slide decks). If the user-provided inputs are not rigorously validated and sanitized before being incorporated into the generated theme definition and subsequently applied, a malicious user could inject arbitrary content (e.g., CSS, HTML, JavaScript) into the target artifact. This could lead to Cross-Site Scripting (XSS) if applied to an HTML page, data exfiltration, or even command injection if the theme application process involves executing shell commands with unsanitized theme data. Implement robust input validation and sanitization for all user-provided inputs used in theme generation. Ensure that all generated theme data (colors, fonts, names) is strictly escaped and validated according to the context (e.g., HTML, CSS, command-line arguments) before being applied to any artifact. The LLM should be explicitly instructed on how to perform this sanitization and validation. | LLM | SKILL.md:55 | |
| MEDIUM | Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | cli-tool/components/mcps/devtools/figma-dev-mode.json:4 | |
| MEDIUM | Broad artifact modification capability with unspecified security safeguards The skill describes the ability to 'apply the selected theme's colors and fonts to the deck/artifact', listing 'slides, docs, reportings, HTML landing pages' as examples. This implies the capability to read, parse, and modify various file types. Without explicit instructions on how these modifications are sandboxed, what specific tools are used, and how file paths/contents are handled, there is a risk of: 1) Excessive Permissions, where the LLM might attempt to modify files outside the intended scope. 2) Data Exfiltration, if the modification process involves reading the entire artifact, potentially exposing sensitive data. 3) Command Injection, if underlying tools are invoked via shell commands and artifact names or content are used without proper escaping. The skill description does not provide any safeguards or limitations for these powerful operations. Explicitly define and limit the scope of 'artifacts' the skill can modify. Specify the exact tools and methods to be used for modification, ensuring they operate within a secure, sandboxed environment. Add clear instructions for the LLM to strictly validate and sanitize all inputs (e.g., artifact paths, content) before processing or passing them to external tools. For HTML artifacts, emphasize the need for strict content security policies and output encoding. | LLM | SKILL.md:18 | |
| LOW | Covert behavior / concealment directives Multiple zero-width characters (stealth text) Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | cli-tool/components/mcps/devtools/jfrog.json:4 |
Scan History
Embed Code
[](https://skillshield.io/report/bd130f96d74fe42e)
Powered by SkillShield