Security Audit

lubusIN/frappe-skills:frappe-app-development

github.com/lubusIN/frappe-skills

AI SkillCommit 113eeaa942b3

CRITICAL

Scanned about 1 month ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

lubusIN/frappe-skills:frappe-app-development received a trust score of 18/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.

SkillShield's automated analysis identified 6 findings: 0 critical, 5 high, 1 medium, and 0 low severity. Key findings include Unsafe deserialization / dynamic eval, Suspicious import: requests.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 25/100, indicating areas for improvement.

Last analyzed on July 19, 2026 (commit 113eeaa9). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

25%

Static Code Analysis

93%

Dependency Graph

100%

LLM Behavioral Safety

100%

Behavioral Risk Signals

Network Access

1 finding

Shell Execution

5 findings

Dynamic Code

5 findings

Excessive Permissions

1 finding

Security Findings6

Severity	Finding	Layer	Location
HIGH	Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions.	Manifest	frappe-app-development/assets/mini-app-template/your_app/api.py:4
HIGH	Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions.	Manifest	frappe-app-development/assets/mini-app-template/your_app/api.py:25
HIGH	Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions.	Manifest	frappe-app-development/assets/mini-app-template/your_app/integrations/sample_connector.py:4
HIGH	Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions.	Manifest	frappe-app-development/assets/mini-app-template/your_app/utils/permissions.py:2
HIGH	Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions.	Manifest	frappe-app-development/assets/mini-app-template/your_app/utils/validation.py:2
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	frappe-app-development/assets/mini-app-template/your_app/integrations/sample_connector.py:2

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/23261a205cdf766d.svg)](https://skillshield.io/report/23261a205cdf766d)