Trust Assessment
miniflux-news received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Suspicious import: urllib.request, Insecure file permissions for API token config file.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Insecure file permissions for API token config file The skill's `miniflux.py` script, when used to configure credentials via the `configure` command (as described in SKILL.md), writes a Miniflux API token to `~/.config/clawdbot/miniflux-news.json`. The provided code snippet for `scripts/miniflux.py` does not explicitly show that this file is created or updated with secure file permissions (e.g., `0o600`). If the file is created with default, less restrictive permissions, the API token could be readable by other users on a multi-user system, leading to unauthorized access to the Miniflux instance. Ensure that the `cmd_configure` function (or wherever the config file is written) explicitly sets the file permissions to `0o600` (user read/write only) using `os.chmod()` immediately after writing the file. For example: `os.chmod(path, 0o600)`. | LLM | scripts/miniflux.py:28 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/hartlco/miniflux-news/scripts/miniflux.py:37 |
Scan History
Embed Code
[](https://skillshield.io/report/f8ed6c27dd228a00)
Powered by SkillShield