Trust Assessment
pikaboard received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 3 high, 0 medium, and 0 low severity. Key findings include Arbitrary code execution during npm install, Arbitrary code execution during npm run build, Uncontrolled external Git repository as a dependency.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary code execution during npm install The skill's installation process includes `npm install` from an external Git repository. `npm install` can execute arbitrary code defined in `package.json` scripts (e.g., `preinstall`, `postinstall`), allowing a malicious package maintainer to execute commands on the host system during skill installation. Review the `package.json` and associated scripts in the `pikaboard` repository for malicious code. Consider sandboxing the installation environment or using a more secure dependency management approach. Pin exact dependency versions. | LLM | Manifest | |
| HIGH | Arbitrary code execution during npm run build The skill's installation process includes `npm run build` from an external Git repository. `npm run build` executes scripts defined in `package.json`, allowing a malicious package maintainer to execute arbitrary commands on the host system during skill installation. Review the `package.json` and associated build scripts in the `pikaboard` repository for malicious code. Consider sandboxing the build environment. | LLM | Manifest | |
| HIGH | Uncontrolled external Git repository as a dependency The skill directly clones an external Git repository (`https://github.com/angelstreet/pikaboard`) during installation. This repository is not pinned to a specific commit or version, meaning its contents can change at any time, introducing a significant supply chain risk. Malicious code could be introduced into the repository, affecting all installations. Pin the Git repository to a specific commit hash or tag to ensure deterministic and auditable installations. Regularly audit the upstream repository for changes. | LLM | Manifest |
Scan History
Embed Code
[](https://skillshield.io/report/5aa216de68f44fb1)
Powered by SkillShield