Trust Assessment
codemod-gen received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Unpinned npm dependency version, Prompt Injection via direct user input.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Prompt Injection via direct user input The user-provided input (`description` argument from the CLI) is directly interpolated into the `userContent` message sent to the OpenAI LLM. An attacker can craft a malicious description to manipulate the LLM's behavior, potentially leading to the generation of harmful or unintended code, or attempts to extract sensitive information if the LLM has access to other tools or context. Implement robust input sanitization or use a templating approach that separates user input from system instructions. Consider using techniques like input validation, escaping, or wrapping user input in XML/JSON tags with clear instructions for the LLM not to interpret content within those tags as instructions. For example, `userContent = `Generate a jscodeshift codemod for: <user_request>${input}</user_request>`. Also, consider using a less powerful model or a model specifically fine-tuned for code generation with strong guardrails. | LLM | src/index.ts:9 | |
| MEDIUM | Unpinned npm dependency version Dependency 'commander' is not pinned to an exact version ('^12.1.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/lxgicstudios/codemod-gen/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/8592882f8aaece48)
Powered by SkillShield