Trust Assessment
pco received a trust score of 75/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Potential Data Exfiltration via Arbitrary File Read, Broad API Access via 'pco api' Command.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Data Exfiltration via Arbitrary File Read The `pco api PATCH /endpoint --file data.json` command, as described, allows the CLI to read the content of a specified local file and send it as part of an API request. If an AI agent using this skill is prompted with untrusted input containing a file path (e.g., `/etc/passwd`, `~/.ssh/id_rsa`, `~/.config/pco-cli/config.json`), it could be coerced into exfiltrating sensitive local files to an external API endpoint. This capability grants excessive filesystem read permissions to the skill. Restrict the `pco api PATCH --file` command to only allow specific, non-sensitive file paths, or implement strict validation to prevent arbitrary file path input. Alternatively, remove the `--file` option if not strictly necessary for the skill's intended function. | LLM | SKILL.md:149 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/rubyrunsstuff/pco/SKILL.md:1 | |
| MEDIUM | Broad API Access via 'pco api' Command The `pco api` command provides 'Direct API access' to the Planning Center Services API, allowing an AI agent to construct and execute arbitrary API calls (GET, POST, PATCH, DELETE) to any endpoint. This grants a very broad set of permissions to the skill, potentially allowing actions beyond the scope of the more specific commands described. While not a direct vulnerability on its own, it significantly increases the attack surface if the LLM is compromised or manipulated by untrusted input, as it could be used to perform unauthorized actions on the Planning Center Services platform. Consider if 'Direct API access' is truly necessary for the skill. If so, implement strict input validation and sanitization for all parameters (`endpoint`, `--data`, `--file`) to prevent malicious payloads or unauthorized access. If possible, restrict the allowed endpoints or HTTP methods. | LLM | SKILL.md:147 |
Scan History
Embed Code
[](https://skillshield.io/report/d0d51e060245cbc8)
Powered by SkillShield