Trust Assessment
environmental-monitoring received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Prompt Injection via Unsanitized Markdown Output.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Prompt Injection via Unsanitized Markdown Output The `generate_report` method constructs a markdown string that directly embeds user-controlled input without proper sanitization. Specifically, `self.site_name`, `station.name`, `station.location.get('description', '-')`, and `values['unit']` are inserted into the markdown report. If an attacker can control these input values (e.g., by providing a malicious station name or unit string), they can inject arbitrary markdown. When this unsanitized markdown is processed by a downstream Large Language Model (LLM), it could lead to prompt injection, allowing the attacker to manipulate the LLM's behavior, extract sensitive information, or generate unintended responses. Implement robust sanitization or escaping for all user-controlled strings (e.g., `site_name`, `station.name`, `location.description`, `unit`) before embedding them into the markdown report generated by `generate_report`. This prevents markdown syntax from being interpreted as instructions by a downstream LLM. Consider using a dedicated markdown escaping utility or library to properly neutralize special markdown characters. | LLM | SKILL.md:400 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/datadrivenconstruction/environmental-monitoring/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/c7536f52f22aa904)
Powered by SkillShield