Security Audit
dkyazzentwatwa/chatgpt-skills:dataset-comparer
github.com/dkyazzentwatwa/chatgpt-skillsTrust Assessment
dkyazzentwatwa/chatgpt-skills:dataset-comparer received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 0 critical, 0 high, 4 medium, and 0 low severity. Key findings include Unpinned Python dependency version, Arbitrary File Read via User-Controlled Path, Arbitrary File Write via User-Controlled Path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 24, 2026 (commit d4bad335). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned Python dependency version Requirement 'pandas>=2.0.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | dataset-comparer/scripts/requirements.txt:1 | |
| MEDIUM | Unpinned Python dependency version Requirement 'numpy>=1.24.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | dataset-comparer/scripts/requirements.txt:2 | |
| MEDIUM | Arbitrary File Read via User-Controlled Path The `_load_file` method directly uses the `filepath` argument, which originates from user input (e.g., CLI arguments `--old`, `--new`). An attacker could provide a path to a sensitive file (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) to read its contents, leading to data exfiltration. While the skill's purpose is to process files, allowing arbitrary paths without validation or sandboxing creates a vulnerability. Implement strict path validation to ensure `filepath` refers only to intended data directories. Consider using a allowlist of allowed directories or a sandboxed environment that restricts file system access. If the skill is intended to read arbitrary user-provided files, ensure the execution environment enforces strong isolation and permission boundaries. | Static | scripts/dataset_comparer.py:39 | |
| MEDIUM | Arbitrary File Write via User-Controlled Path The `generate_report` method directly uses the `output` argument, which originates from user input (e.g., CLI argument `--report`). An attacker could provide a path to an arbitrary location (e.g., `/tmp/sensitive_data.html`, `/var/www/html/malicious.html`) to write the generated report, potentially overwriting existing files, creating new files in unintended locations, or facilitating data exfiltration if the output path is publicly accessible. This could also lead to a denial-of-service by filling up disk space or overwriting critical system files. Implement strict path validation to ensure `output` refers only to intended output directories. Consider using a allowlist of allowed directories or a sandboxed environment that restricts file system access. Ensure the execution environment enforces strong isolation and permission boundaries to prevent writing to critical system locations. | Static | scripts/dataset_comparer.py:234 |
Scan History
Embed Code
[](https://skillshield.io/report/c3c0a4364c8a2936)
Powered by SkillShield