Trust Assessment
design-fhir-loinc-questionnaires received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 13 findings: 1 critical, 0 high, 11 medium, and 1 low severity. Key findings include Unsafe deserialization / dynamic eval, Suspicious import: urllib, Unpinned Python dependency version.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 58/100, indicating areas for improvement.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings13
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Prompt Injection via Untrusted Instructions The SKILL.md file, designated as untrusted input, contains explicit instructions intended to manipulate the host LLM's behavior. Directives such as 'NEVER suggest LOINC or SNOMED CT codes from memory or training data. ALWAYS use the search and query scripts in this skill.' and 'ALWAYS run `python scripts/search_loinc.py "search term"` FIRST' attempt to override the LLM's default reasoning and action selection. This violates the core security principle of treating all content within untrusted delimiters as data, not instructions, and not allowing it to override the LLM's operational guidelines. Remove all direct instructions to the LLM from untrusted content. If specific behaviors are required, they should be enforced by the agent's system prompt or configuration, not by the skill's untrusted documentation. | LLM | SKILL.md:10 | |
| MEDIUM | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/elmariachi111/fhir-questionnaire/scripts/create_custom_codesystem.py:17 | |
| MEDIUM | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/elmariachi111/fhir-questionnaire/scripts/create_custom_codesystem.py:306 | |
| MEDIUM | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/elmariachi111/fhir-questionnaire/scripts/extract_loinc_codes.py:12 | |
| MEDIUM | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/elmariachi111/fhir-questionnaire/scripts/extract_loinc_codes.py:202 | |
| MEDIUM | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/elmariachi111/fhir-questionnaire/scripts/extract_loinc_codes.py:239 | |
| MEDIUM | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/elmariachi111/fhir-questionnaire/scripts/extract_loinc_codes.py:291 | |
| MEDIUM | Suspicious import: urllib Import of 'urllib' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/elmariachi111/fhir-questionnaire/scripts/query_valueset.py:23 | |
| MEDIUM | Suspicious import: urllib Import of 'urllib' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/elmariachi111/fhir-questionnaire/scripts/search_loinc.py:17 | |
| MEDIUM | Suspicious import: urllib Import of 'urllib' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/elmariachi111/fhir-questionnaire/scripts/search_snomed.py:17 | |
| MEDIUM | Unpinned Python dependency version Requirement 'jsonschema>=4.0.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | skills/elmariachi111/fhir-questionnaire/requirements.txt:1 | |
| MEDIUM | Potential Data Exfiltration via Arbitrary Server Specification The `scripts/query_valueset.py` script allows specifying an arbitrary FHIR terminology server via the `--server` command-line argument. While the `SKILL.md` provides a list of whitelisted servers, if the LLM were to accept an untrusted URL for `--server` from user input, it could direct the script to send the `loinc_code` or `search` query (which may contain sensitive clinical terms) to a malicious server. This creates a potential path for data exfiltration of the search query content. Implement strict validation or whitelisting of server URLs within the LLM's action selection logic. The skill should only allow the LLM to use pre-approved, trusted server endpoints for external API calls. Consider removing the `--server` argument if dynamic server selection is not a core requirement, or ensure it's only configurable by trusted sources. | LLM | scripts/query_valueset.py:240 | |
| LOW | Unpinned Dependency in requirements.txt The `requirements.txt` file specifies `jsonschema>=4.0.0`. While this ensures a minimum version, using a flexible version specifier (`>=`) rather than an exact pin (`==`) can lead to unexpected behavior or introduce vulnerabilities if a newer version of the dependency contains breaking changes or security flaws. Exact pinning is recommended for production environments to ensure reproducibility and stability. Pin all dependencies to exact versions (e.g., `jsonschema==4.x.y`) in `requirements.txt` to ensure consistent and secure environments across deployments. Regularly review and update these pins to incorporate security patches. | LLM | requirements.txt:1 |
Scan History
Embed Code
[](https://skillshield.io/report/f42f239c75bb7fe8)
Powered by SkillShield