Trust Assessment
coda received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Suspicious import: requests, Suspicious import: urllib.request, Skill provides direct data exfiltration capabilities.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Skill provides direct data exfiltration capabilities The skill's primary function includes reading and exporting data from Coda documents. Functions like `list_all`, `get`, `export_table_to_csv`, and `_output_result` can output potentially sensitive Coda document data to standard output or a specified file. If an attacker gains control over the LLM's execution of this skill, they can instruct it to export and exfiltrate sensitive user data from Coda documents. The skill's documentation explicitly acknowledges this risk under 'Data Exposure: Row data may contain sensitive information; handle exports carefully.' Implement strict access controls and monitoring for LLM interactions that involve this skill, especially when invoked with data export commands. Establish policies to prevent the LLM from transmitting exported data to untrusted external destinations. Users should be explicitly warned about the sensitive nature of data being exported and the implications of using this skill for data extraction. | LLM | scripts/coda_cli.py:400 | |
| MEDIUM | Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/0x7466/coda/scripts/coda_cli.py:28 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/0x7466/coda/scripts/coda_cli.py:32 |
Scan History
Embed Code
[](https://skillshield.io/report/97bbffe686e00e9b)
Powered by SkillShield