Trust Assessment
bible received a trust score of 64/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 2 high, 1 medium, and 0 low severity. Key findings include Suspicious import: urllib.request, Potential data exfiltration: file read + network send, Arbitrary File Write via Unvalidated Command Line Argument.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential data exfiltration: file read + network send Function 'download_image' reads files and sends data over the network. This may indicate data exfiltration. Review this function to ensure file contents are not being sent to external servers. | Static | skills/dbhurley/bible-votd/votd.py:59 | |
| HIGH | Arbitrary File Write via Unvalidated Command Line Argument The skill allows writing the downloaded image to an arbitrary file path specified by the user via command line arguments. The `sys.argv[2]` value is directly used as the `output_path` for the `download_image` function without any validation or sanitization. An attacker could specify a sensitive file path (e.g., `/etc/passwd`, `~/.bashrc`) to overwrite system or user configuration files, leading to denial of service, privilege escalation, or persistent compromise depending on the execution context and target file permissions. Restrict the output directory to a designated, sandboxed location (e.g., a skill-specific temporary directory). Alternatively, sanitize the provided path to prevent directory traversal (e.g., remove '..' or '/' characters) and ensure it only specifies a filename within a safe directory. Consider using `tempfile` module for secure temporary file creation if the exact output path is not critical for the user. | LLM | votd.py:61 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/dbhurley/bible-votd/votd.py:10 |
Scan History
Embed Code
[](https://skillshield.io/report/8aa5e417fc0cc153)
Powered by SkillShield