Trust Assessment
skill-scanner received a trust score of 66/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 2 high, 1 medium, and 0 low severity. Key findings include Unsafe deserialization / dynamic eval, Zip Slip vulnerability during skill archive extraction, Cross-Site Scripting (XSS) in Streamlit UI via unsanitized findings.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/bvinci1-design/skill-scanner/skill_scanner.py:172 | |
| HIGH | Cross-Site Scripting (XSS) in Streamlit UI via unsanitized findings The `streamlit_ui.py` component uses `st.markdown(unsafe_allow_html=True)` to display scan findings, including `finding.description`, `finding.recommendation`, and `finding.line_content`. These fields are populated directly from the content of the scanned skill. If a malicious skill contains HTML or JavaScript payloads within its code, comments, or documentation (e.g., `SKILL.md`), these payloads could be rendered unsafely in the user's browser, leading to a Cross-Site Scripting (XSS) vulnerability. This could allow an attacker to execute arbitrary client-side scripts, potentially leading to session hijacking, data exfiltration from the user's browser, or UI defacement. Sanitize all user-controlled input (e.g., `finding.description`, `finding.recommendation`, `finding.line_content`) before rendering it with `st.markdown(unsafe_allow_html=True)`. Use a robust HTML sanitization library (e.g., `bleach`) to strip out dangerous tags and attributes. Alternatively, avoid `unsafe_allow_html=True` for displaying content derived from scanned skills, or ensure that only plain text is displayed for such fields. | LLM | streamlit_ui.py:260 | |
| MEDIUM | Zip Slip vulnerability during skill archive extraction The `streamlit_ui.py` component extracts uploaded ZIP archives using `zipfile.extractall()` without validating the paths of the archive members. A malicious ZIP file could contain entries with paths like `../../evil.txt`, which could lead to a 'Zip Slip' vulnerability. Although the extraction occurs within a `tempfile.TemporaryDirectory`, this could still allow an attacker to overwrite files within that temporary directory, potentially interfering with the scanning process or leading to resource exhaustion. Before calling `zipfile.extractall()`, iterate through `zip_ref.namelist()` and validate each member's path to ensure it does not escape the intended extraction directory. A common approach is to check if `os.path.commonprefix([temp_path, extracted_path]) == temp_path` for each extracted file. | LLM | streamlit_ui.py:140 |
Scan History
Embed Code
[](https://skillshield.io/report/2bb1cffd71727965)
Powered by SkillShield