Trust Assessment
frinkiac received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Arbitrary package execution via unpinned `npx -y` in MCP server configuration.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary package execution via unpinned `npx -y` in MCP server configuration The skill's `mcpServers` configuration specifies `npx -y @ryantenney/frinkiac-mcp` as the command to start its server. The `-y` flag automatically confirms the installation of the npm package, bypassing user consent. Furthermore, the package `@ryantenney/frinkiac-mcp` is not pinned to a specific version. This combination creates a critical supply chain risk: if the package or any of its dependencies are compromised, or if a malicious version is published, arbitrary code could be installed and executed on the host system without explicit user interaction. This grants excessive permissions to the skill and is a direct command injection vector. 1. Remove the `-y` flag from the `npx` command to require explicit user confirmation before installing the package. 2. Pin the `@ryantenney/frinkiac-mcp` package to a specific, known-good version (e.g., `"@ryantenney/frinkiac-mcp@1.2.3"`) to prevent unexpected or malicious updates. 3. Consider using a more sandboxed execution environment if the skill's functionality can be achieved without full arbitrary code execution capabilities. | LLM | SKILL.md:20 |
Scan History
Embed Code
[](https://skillshield.io/report/07ddf68c3808626d)
Powered by SkillShield