Trust Assessment
queue-gen received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Unpinned npm dependency version, Direct User Input to LLM (Prompt Injection).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Direct User Input to LLM (Prompt Injection) The skill directly passes user-provided input (`description`) as a 'user' message to the OpenAI API without any sanitization, validation, or wrapping. This allows an attacker to craft malicious input to manipulate the underlying Large Language Model (LLM), potentially overriding the system prompt, generating harmful content, or attempting to extract sensitive information from the LLM's context. Implement robust input sanitization and validation for the `description` parameter. Consider wrapping user input with clear delimiters (e.g., XML tags, JSON objects) in the prompt to explicitly separate it from system instructions. Alternatively, use a separate LLM call to validate or rephrase user input before passing it to the main generation prompt. Ensure the system prompt is robust against adversarial inputs. | LLM | src/index.ts:8 | |
| MEDIUM | Unpinned npm dependency version Dependency 'commander' is not pinned to an exact version ('^12.1.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/lxgicstudios/queue-gen/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/7ce7423fd527a341)
Powered by SkillShield