Trust Assessment
claude-agent-sdk received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 8 findings: 3 critical, 1 high, 2 medium, and 2 low severity. Key findings include File read + network send exfiltration, Unpinned npm dependency version, Node lockfile missing.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings8
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Manifest | skills/veeramanikandanr48/claude-agent-sdk/templates/filesystem-settings.ts:21 | |
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Manifest | skills/veeramanikandanr48/claude-agent-sdk/templates/filesystem-settings.ts:177 | |
| CRITICAL | Direct `eval()` of untrusted input in custom tool The `calculate` tool within the `database` MCP server in `custom-mcp-server.ts` uses `eval()` on the `args.expression` parameter. This parameter is derived from the agent's input, allowing arbitrary code execution if a malicious expression is provided by the agent or a compromised prompt. This is a severe command injection vulnerability. Replace `eval()` with a safe mathematical expression parser (e.g., `mathjs`) or a secure sandboxed execution environment. Never use `eval()` with untrusted or user-controlled input. | LLM | templates/custom-mcp-server.ts:109 | |
| HIGH | `bypassPermissions` mode allows agent to skip all security checks The Claude Agent SDK provides a `permissionMode: "bypassPermissions"` option, which is explicitly described in `SKILL.md` and demonstrated in `templates/permission-control.ts` as skipping ALL permission checks. While warned against, its availability and example usage present a critical risk if enabled in production or with untrusted agents, allowing the agent to perform any action (e.g., file writes, shell commands) without user approval or internal validation. Avoid using `permissionMode: "bypassPermissions"` in any production or untrusted environment. Use `default` mode with a robust `canUseTool` callback for fine-grained control and explicit approval mechanisms. | LLM | SKILL.md:290 | |
| MEDIUM | Unpinned npm dependency version Dependency '@anthropic-ai/claude-agent-sdk' is not pinned to an exact version ('^0.2.12'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/veeramanikandanr48/claude-agent-sdk/templates/package.json | |
| MEDIUM | Logging of raw tool inputs and results may exfiltrate sensitive data Several example templates, such as `templates/query-with-tools.ts` and `templates/permission-control.ts` (in `loggingPermissions`), demonstrate logging raw `message.input` for tool calls and `message.content` or `message.result` for assistant responses and tool results directly to `console.log`. If these messages or inputs contain sensitive information (e.g., file contents, API responses, user data, environment variables), this logging practice could lead to unintended data exfiltration through logs. Implement careful sanitization or redaction of sensitive information before logging tool inputs, outputs, or agent messages. Avoid logging raw, unfiltered data in production environments. Consider using structured logging with appropriate access controls. | LLM | templates/query-with-tools.ts:29 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/veeramanikandanr48/claude-agent-sdk/templates/package.json | |
| LOW | Unpinned dependencies in example `package.json` The `package.json` for the example templates uses caret (`^`) ranges for several dependencies, including `@anthropic-ai/claude-agent-sdk`, `zod`, and `zod-to-json-schema`. This allows for automatic updates to minor or patch versions, which could introduce breaking changes, vulnerabilities, or unexpected behavior if a malicious update is published (e.g., typosquatting, compromised package). The `zod` dependency also allows two major versions (`^3.24.0 || ^4.0.0`), which is unusual and could lead to compatibility issues. Pin dependencies to exact versions (e.g., `"0.2.12"`) to ensure deterministic builds and prevent unexpected updates. Regularly audit and update dependencies. For `zod`, choose a single major version and pin it. | LLM | templates/package.json:12 |
Scan History
Embed Code
[](https://skillshield.io/report/b1f5da7d848c55c2)
Powered by SkillShield