Trust Assessment
linkedin-pipedream received a trust score of 84/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 1 low severity. Key findings include Direct access to sensitive configuration file, API response logged to console.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Direct access to sensitive configuration file The 'org-post.mjs' script directly reads 'clientId', 'clientSecret', and 'projectId' from '~/.config/pdauth/config.json'. This exposes sensitive Pipedream credentials to the script's execution environment. If the script or its environment is compromised, these credentials could be exfiltrated. While intended as a workaround, it bypasses the abstraction of the 'pdauth' CLI for credential management. Avoid direct file system access to credential files within skill code. Instead, rely on secure credential management provided by the platform or the 'pdauth' skill itself (e.g., via environment variables or a secure API). If direct access is unavoidable, ensure strict permissions on the config file and robust input validation for any parameters that might influence file paths. | LLM | org-post.mjs:14 | |
| LOW | API response logged to console The 'org-post.mjs' script logs the full Pipedream API response to standard output using `console.log(JSON.stringify(result, null, 2))`. Depending on the API's response content, this could expose sensitive information if the output is captured or stored in an insecure manner. Review the content of API responses and redact any sensitive fields before logging to console, especially in production environments or when output might be stored. Consider logging only necessary status or non-sensitive identifiers. | LLM | org-post.mjs:48 |
Scan History
Embed Code
[](https://skillshield.io/report/f7f95a708884c375)
Powered by SkillShield