Trust Assessment
context-onboarding received a trust score of 37/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 4 findings: 1 critical, 2 high, 1 medium, and 0 low severity. Key findings include Arbitrary command execution, Dangerous call: subprocess.run(), Arbitrary File Read (Data Exfiltration).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/crimsondevil333333/context-onboarding/tests/test_context_onboarding.py:11 | |
| HIGH | Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'run_workspace'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/crimsondevil333333/context-onboarding/tests/test_context_onboarding.py:11 | |
| HIGH | Arbitrary File Read (Data Exfiltration) The skill's core functionality allows reading arbitrary files from the filesystem based on user-provided paths. The `--files` argument accepts a list of file paths, and the `--workspace` argument allows specifying an arbitrary root directory. This combination, especially when combined with path traversal techniques (e.g., `../`), enables an attacker to read sensitive files outside the intended scope of the skill, leading to data exfiltration. The content of these files is then printed to standard output. Implement strict input validation for `--files` and `--workspace` arguments. Restrict file access to a predefined set of allowed files or a confined directory. Prevent path traversal (`..`) and absolute paths outside the skill's intended operational scope. Consider whitelisting file extensions or specific file names if possible. | LLM | scripts/context_onboarding.py:34 | |
| MEDIUM | Excessive Filesystem Permissions The skill is designed to read 'workspace identity documents' but its implementation grants overly broad filesystem access. The `--workspace` argument allows the skill to operate on any directory, and the `--files` argument allows specifying any file path within that (or a relative) context. This broad access is excessive for a skill whose primary purpose is to summarize specific configuration files, increasing the attack surface for data exfiltration if untrusted input is processed. Limit the skill's filesystem access to only the directories and files strictly necessary for its intended function. If a `--workspace` argument is required, validate that it points to a safe, confined location. Alternatively, remove the ability to specify arbitrary file paths and instead rely on a predefined list of files relative to a secure base directory. | LLM | scripts/context_onboarding.py:50 |
Scan History
Embed Code
[](https://skillshield.io/report/504dac95a04cdeef)
Powered by SkillShield