Trust Assessment
letterboxd-watchlist received a trust score of 87/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Suspicious import: urllib.request, Arbitrary File Write via Unsanitized Output Path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/0xnuminous/letterboxd-watchlist/scripts/scrape_watchlist.py:17 | |
| MEDIUM | Arbitrary File Write via Unsanitized Output Path The `scripts/scrape_watchlist.py` script uses the `--out` command-line argument directly as a file path for writing output (CSV or JSONL). If the AI agent passes an unsanitized, user-controlled path to this argument, it could lead to arbitrary file creation or overwrite. This could allow path traversal (e.g., `../../sensitive.csv`) or writing to unintended system locations, potentially overwriting critical files or exfiltrating data by writing it to an accessible location. The skill should sanitize or restrict the output path. For example, by ensuring the path is within a designated output directory, normalizing the path to prevent traversal, or using a temporary file API if appropriate. The calling AI agent should also sanitize user-provided paths before passing them to skill arguments. | LLM | scripts/scrape_watchlist.py:124 |
Scan History
Embed Code
[](https://skillshield.io/report/ab7185f8bf7273bb)
Powered by SkillShield