Trust Assessment
control-ikea-lightbulb received a trust score of 91/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Unpinned Python dependency version, Unpinned dependency version.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned Python dependency version Dependency 'python-kasa>=0.10.2' is not pinned to an exact version. Pin Python dependencies with exact versions where feasible. | Dependencies | skills/antgly/control-ikea-lightbulb/pyproject.toml | |
| LOW | Unpinned dependency version The 'python-kasa' dependency is specified with a minimum version ('python-kasa>=0.10.2') but not pinned to a specific version. This allows for automatic updates to newer versions within the specified range, which could introduce breaking changes or security vulnerabilities if a malicious or buggy update is published to the package repository. It is recommended to pin dependencies to exact versions or use a lock file for reproducible builds and to mitigate supply chain risks. Pin the 'python-kasa' dependency to an exact version (e.g., 'python-kasa==0.10.2') or use a dependency lock file (e.g., `uv.lock` or `pip freeze > requirements.txt`) to ensure reproducible and secure builds. | LLM | pyproject.toml:7 |
Scan History
Embed Code
[](https://skillshield.io/report/b86cdef6d9edccc4)
Powered by SkillShield