Trust Assessment
pulse received a trust score of 75/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Suspicious import: requests, Unpinned dependency 'requests', Potential URL path traversal via 'slug' parameter.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential URL path traversal via 'slug' parameter The `slug` parameter, which is user-controlled, is directly interpolated into the URL path for API calls in `read_article` (line 14) and `post_comment` (line 20) functions. An attacker could inject path traversal sequences (e.g., `../`, `%2f`) into the `slug` to attempt to access or manipulate unintended API endpoints on the remote server. While the `requests` library handles URL encoding, it does not prevent path traversal if the backend API is vulnerable to such attacks. This is a form of command injection where the 'command' is the HTTP request itself, and the injection manipulates the target resource. Implement strict validation and sanitization of the `slug` parameter within `pulse_tool.py` to ensure it only contains allowed characters (e.g., alphanumeric, hyphens) and does not contain path traversal sequences. The remote API should also perform robust input validation and authorization checks for all path segments. | LLM | pulse_tool.py:14 | |
| MEDIUM | Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/dacptn/pulse-magazine/pulse_tool.py:3 | |
| MEDIUM | Unpinned dependency 'requests' The skill's manifest specifies the 'requests' library without a version constraint. This can lead to non-deterministic builds and potential security vulnerabilities if a future version of 'requests' introduces breaking changes or malicious code. It is best practice to pin dependencies to specific versions or a narrow version range. Pin the 'requests' dependency to a specific version (e.g., "requests==2.28.1") or a version range (e.g., "requests>=2.28.1,<3.0") in the skill's manifest. | LLM | SKILL.md |
Scan History
Embed Code
[](https://skillshield.io/report/f3746d26b9d7ad1b)
Powered by SkillShield