Trust Assessment
arxiv-1-0-1 received a trust score of 64/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 6 findings: 0 critical, 0 high, 5 medium, and 1 low severity. Key findings include Missing required field: name, Unpinned npm dependency version, Node lockfile missing.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings6
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/tariqsumatri82/arxiv-1-0-1/SKILL.md:1 | |
| MEDIUM | Unpinned npm dependency version Dependency 'python' is not pinned to an exact version ('>=3.8'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/tariqsumatri82/arxiv-1-0-1/package.json | |
| MEDIUM | Unpinned Python dependency version Requirement 'arxiv>=2.0.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | skills/tariqsumatri82/arxiv-1-0-1/requirements.txt:1 | |
| MEDIUM | Unpinned Python dependency version Requirement 'pymongo>=4.0.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | skills/tariqsumatri82/arxiv-1-0-1/requirements.txt:2 | |
| MEDIUM | Potential Path Traversal via Environment Variable for Download Directory The skill uses the `ARXIV_PAPERS_DIR` environment variable to determine the output directory for downloaded PDFs. This variable is used directly in `Path(output_dir).mkdir(...)` without explicit sanitization against path traversal sequences (e.g., `../`). If an attacker can control the `ARXIV_PAPERS_DIR` environment variable and the skill is executed with broad filesystem write permissions, they could cause the skill to create directories and write files to arbitrary locations on the host system. Sanitize the `ARXIV_PAPERS_DIR` environment variable to ensure it is a safe, absolute path within an allowed directory, or restrict the skill's filesystem permissions to prevent writing outside its designated data directory. For example, resolve the path to an absolute path and ensure it's a subdirectory of a known safe base path. | LLM | arxiv_tool.py:59 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/tariqsumatri82/arxiv-1-0-1/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/fa5071d9a7f661ec)
Powered by SkillShield