Trust Assessment
truenas-skill received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 6 findings: 3 critical, 0 high, 1 medium, and 2 low severity. Key findings include Network egress to untrusted endpoints, Unpinned npm dependency version, Default TLS Certificate Validation Skipped in cURL Examples.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 10/100, indicating areas for improvement.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings6
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | skills/anotb/truenas-skill/scripts/dockge-list.mjs:16 | |
| CRITICAL | Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | skills/anotb/truenas-skill/scripts/dockge-update.mjs:17 | |
| CRITICAL | Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | skills/anotb/truenas-skill/scripts/truenas-ws.mjs:16 | |
| MEDIUM | Unpinned npm dependency version Dependency 'socket.io-client' is not pinned to an exact version ('^4.8.3'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/anotb/truenas-skill/package.json | |
| LOW | Default TLS Certificate Validation Skipped in cURL Examples The skill's documentation and cURL examples explicitly use the `-k` flag, which disables TLS/SSL certificate validation. This is stated to accommodate self-signed certificates common in homelab environments. While convenient, this practice makes communications vulnerable to Man-in-the-Middle (MITM) attacks if the network is compromised. The skill mentions `TRUENAS_VERIFY_TLS=1` as an option to enforce strict TLS validation. Advise users to set `TRUENAS_VERIFY_TLS=1` for production environments or whenever strict security is required. Ensure the LLM agent prioritizes this setting if available and appropriate for the user's security posture. | LLM | SKILL.md:100 | |
| LOW | Default TLS Certificate Validation Skipped in WebSocket Client The `scripts/truenas-ws.mjs` script, used for TrueNAS WebSocket API calls, defaults to `rejectUnauthorized: false` for TLS connections unless `TRUENAS_VERIFY_TLS` is explicitly set to '1'. This means the script will not validate the server's TLS certificate, which can make the connection vulnerable to Man-in-the-Middle (MITM) attacks. This behavior is documented as a feature for self-signed certificates. Advise users to set `TRUENAS_VERIFY_TLS=1` for production environments or whenever strict security is required. Ensure the LLM agent prioritizes this setting if available and appropriate for the user's security posture. | LLM | scripts/truenas-ws.mjs:40 |
Scan History
Embed Code
[](https://skillshield.io/report/c4887bb6c625e7d1)
Powered by SkillShield