Trust Assessment
find-stl received a trust score of 64/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 2 high, 1 medium, and 0 low severity. Key findings include Suspicious import: urllib.request, Potential data exfiltration: file read + network send, Path Traversal in Output Directory.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential data exfiltration: file read + network send Function 'download_file' reads files and sends data over the network. This may indicate data exfiltration. Review this function to ensure file contents are not being sent to external servers. | Static | skills/ajmwagar/find-stl/scripts/find_stl.py:116 | |
| HIGH | Path Traversal in Output Directory The `cmd_fetch` function constructs a base directory for downloads and extractions using `os.path.join(args.outdir, ...)`. The `args.outdir` argument is directly taken from user input via `argparse` without proper sanitization. An attacker can provide a path containing traversal sequences (e.g., `../../../../tmp`) for `args.outdir`, causing downloaded files and extracted contents to be written outside the intended output directory. This could lead to arbitrary file writes, potentially overwriting sensitive system files, writing malicious content to arbitrary locations, or causing a denial of service by filling up disk space in unintended locations. Sanitize the `args.outdir` input to ensure it does not contain path traversal sequences. A robust solution involves resolving the absolute path of `args.outdir` and verifying that it remains within a predefined, safe base directory. For example, use `os.path.abspath(os.path.join(safe_base_dir, args.outdir))` and then check if the resulting path starts with `safe_base_dir`. | LLM | scripts/find_stl.py:129 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/ajmwagar/find-stl/scripts/find_stl.py:30 |
Scan History
Embed Code
[](https://skillshield.io/report/ccfe47f9d979ad76)
Powered by SkillShield