Trust Assessment
memory-lancedb-hybrid received a trust score of 69/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 0 critical, 1 high, 3 medium, and 0 low severity. Key findings include Sensitive environment variable access: $OPENAI_API_KEY, Unpinned npm dependency version, Generic Environment Variable Resolution Allows Potential Data Exfiltration.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Generic Environment Variable Resolution Allows Potential Data Exfiltration The `resolveEnvVars` function in `plugin/config.ts` is designed to replace `${ENV_VAR_NAME}` patterns in a string with the corresponding environment variable's value. This function is applied to the `embedding.apiKey` configuration field. While intended for `"${OPENAI_API_KEY}"`, if the `embedding.apiKey` value can be influenced by untrusted input (e.g., through a prompt injection attack on the host LLM that generates or modifies the skill's configuration), an attacker could potentially inject `"${SENSITIVE_ENV_VAR}"` to exfiltrate arbitrary environment variables. The function does not whitelist allowed environment variable names, making it a generic exfiltration vector. Modify `resolveEnvVars` to only allow a predefined whitelist of environment variable names (e.g., `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, etc.) or ensure that the input to `embedding.apiKey` is strictly validated to prevent arbitrary environment variable names from being injected. Alternatively, ensure that the configuration parsing mechanism explicitly prevents LLM-generated content from directly influencing sensitive configuration fields without strict validation. | LLM | plugin/config.ts:100 | |
| MEDIUM | Sensitive environment variable access: $OPENAI_API_KEY Access to sensitive environment variable '$OPENAI_API_KEY' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/joeykrug/memory-lancedb-hybrid/SKILL.md:66 | |
| MEDIUM | Unpinned npm dependency version Dependency '@lancedb/lancedb' is not pinned to an exact version ('^0.24.1'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/joeykrug/memory-lancedb-hybrid/plugin/package.json | |
| MEDIUM | Unpinned Major/Minor Dependencies in package.json The `package.json` file specifies dependencies using caret (`^`) ranges for `@lancedb/lancedb` (`^0.24.1`) and `openai` (`^6.18.0`). This allows `npm install` to fetch new major or minor versions of these packages, which could introduce breaking changes, new vulnerabilities, or even malicious code if a future version is compromised. While `package-lock.json` pins exact versions, relying solely on it can be risky if the lockfile is not strictly enforced or is compromised. For production-grade skills, it is generally safer to pin dependencies to exact versions or use more restrictive ranges (e.g., `~` for patch updates only) to ensure deterministic builds and reduce the risk of unexpected changes. Update `package.json` to use exact version pinning (e.g., `"@lancedb/lancedb": "0.24.1"`) or more restrictive tilde (`~`) ranges (e.g., `"@lancedb/lancedb": "~0.24.1"`) for all dependencies to ensure consistent and predictable builds. | LLM | plugin/package.json:6 |
Scan History
Embed Code
[](https://skillshield.io/report/9a852520d5c9b71d)
Powered by SkillShield