Trust Assessment
tandoor-recipes received a trust score of 71/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 5 findings: 0 critical, 0 high, 4 medium, and 1 low severity. Key findings include Unpinned npm dependency version, Node lockfile missing, Unencoded URL parameter 'fromDate' in getMealPlans.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned npm dependency version Dependency 'zod' is not pinned to an exact version ('^3.23.8'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/itsnikhil/tandoor-recipes/scripts/package.json | |
| MEDIUM | Unencoded URL parameter 'fromDate' in getMealPlans The `getMealPlans` function constructs an API URL using the `fromDate` parameter directly without URL encoding. An attacker could inject malicious query parameters or manipulate the API request by providing a `fromDate` value containing characters like `&` or `?`. This could lead to unexpected API responses, data exposure, or denial of service if the backend processes the malformed URL. Apply `encodeURIComponent()` to the `fromDate` parameter before appending it to the URL. For example: `let url = `/api/meal-plan/?from_date=${encodeURIComponent(fromDate)}`;` | LLM | scripts/tandoor.js:69 | |
| MEDIUM | Unencoded URL parameter 'toDate' in getMealPlans The `getMealPlans` function constructs an API URL using the `toDate` parameter directly without URL encoding. An attacker could inject malicious query parameters or manipulate the API request by providing a `toDate` value containing characters like `&` or `?`. This could lead to unexpected API responses, data exposure, or denial of service if the backend processes the malformed URL. Apply `encodeURIComponent()` to the `toDate` parameter before appending it to the URL. For example: `url += `&to_date=${encodeURIComponent(toDate)}`;` | LLM | scripts/tandoor.js:71 | |
| MEDIUM | Unencoded URL parameter 'checked' in getShoppingList The `getShoppingList` function constructs an API URL using the `checked` parameter directly without URL encoding. An attacker could inject malicious query parameters or manipulate the API request by providing a `checked` value containing characters like `&` or `?`. This could lead to unexpected API responses, data exposure, or denial of service if the backend processes the malformed URL. Apply `encodeURIComponent()` to the `checked` parameter before appending it to the URL. For example: `const items = await apiRequest(`/api/shopping-list-entry/?checked=${encodeURIComponent(checked)}`, ShoppingListResponseSchema);` | LLM | scripts/tandoor.js:79 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/itsnikhil/tandoor-recipes/scripts/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/97057812880c5242)
Powered by SkillShield