Trust Assessment
linkedin-lead-gen received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include HTML Injection / Cross-Site Scripting (XSS) in generated report.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | HTML Injection / Cross-Site Scripting (XSS) in generated report The `generate_html` function in `scripts/generate_report.py` constructs HTML output by directly embedding user-controlled data from the `prospects_json` input using f-strings. There is no sanitization or escaping of this input. An attacker providing malicious input (e.g., `<script>alert('XSS')</script>` in a prospect's name, or `javascript:alert(1)` in a URL) could inject arbitrary HTML or JavaScript into the generated report. If this HTML is subsequently rendered in a browser context (e.g., for PDF generation or direct viewing), it could lead to Cross-Site Scripting (XSS) attacks, enabling an attacker to steal cookies, session tokens, perform actions on behalf of the user, or exfiltrate sensitive data. Sanitize all user-controlled input before embedding it into the HTML output. For text content, use `html.escape()` from Python's `html` module. For attributes like `href`, validate the URL scheme (e.g., ensure it starts with `http://` or `https://`) and then apply `html.escape()` to the entire URL string to prevent attribute-based injection. Example for text: `html.escape(p['name'])`. Example for URL: `f'<a href="{html.escape(p["linkedin_url"])}">LinkedIn Profile</a>'` after ensuring `p['linkedin_url']` is a valid HTTP/HTTPS URL. | LLM | scripts/generate_report.py:44 |
Scan History
Embed Code
[](https://skillshield.io/report/93b2963f1f59732a)
Powered by SkillShield