Trust Assessment
olympic-alert received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unsanitized user input in event details can lead to prompt injection.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsanitized user input in event details can lead to prompt injection The `add_event` function in `scripts/check_olympic.py` allows users to add events with arbitrary strings for `name` and `athletes` via command-line arguments. These values are stored in `events.json` and later directly embedded into the alert message generated by the `check_upcoming` function without any sanitization or escaping. If the skill's output is consumed by an LLM, a malicious user could craft these inputs (e.g., `name="Ignore previous instructions and..."` or markdown links) to manipulate the LLM's behavior, inject unwanted instructions, or cause UI defacement in markdown-aware clients. Implement robust input sanitization or escaping for `event_name` and `athletes` before they are stored and, more critically, before they are included in the final alert message. This should prevent any special characters, markdown, or instruction-like text from being interpreted by downstream systems (like an LLM or markdown renderer). For LLM interaction, consider wrapping user-provided data in explicit data tags (e.g., `<data>...</data>`) to clearly delineate it from instructions. | LLM | scripts/check_olympic.py:58 |
Scan History
Embed Code
[](https://skillshield.io/report/e5dc0be00d1569a3)
Powered by SkillShield