Trust Assessment
Meta Tags - SEO Tag Generator received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Unpinned npm package dependency, Tool allows arbitrary file read/write.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unpinned npm package dependency The skill instructs to install the npm package `@lxgicstudios/meta-tags` globally without specifying a version. This means that future installations could pull a malicious or vulnerable version if the package maintainer's account is compromised or if a new maintainer introduces malicious code, leading to potential arbitrary code execution. Pin the dependency to a specific version, e.g., `npm install -g @lxgicstudios/meta-tags@1.2.3`. Regularly audit and update the pinned version. | LLM | SKILL.md:8 | |
| MEDIUM | Tool allows arbitrary file read/write The `meta-tags` CLI tool described in the skill has options (`--config` for reading and `-o` for writing) that allow interaction with local file paths. If the LLM is allowed to execute this tool with user-controlled or unvalidated file paths, it could lead to data exfiltration (reading sensitive files via `--config`) or system modification/command injection (overwriting critical files via `-o`). This capability, while inherent to many CLI tools, poses a risk in an LLM agent context if not properly sandboxed. Ensure the LLM's execution environment is strictly sandboxed, preventing access to arbitrary file paths. Validate and sanitize any user-provided file paths before passing them to the `meta-tags` tool. Consider restricting the LLM's ability to use the `--config` and `-o` options with arbitrary paths. | LLM | SKILL.md:26 |
Scan History
Embed Code
[](https://skillshield.io/report/349cb283e652025c)
Powered by SkillShield