Trust Assessment
veadk-skills received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Arbitrary File Write via Unsanitized Script Arguments.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary File Write via Unsanitized Script Arguments The `SKILL.md` instructs the LLM to execute `python save_file.py` with `--path` and `--content` arguments. The `scripts/save_file.py` script uses `os.makedirs(os.path.dirname(file_path), exist_ok=True)` and `with open(file_path, "w", encoding="utf-8") as f:` directly with these arguments (`file_path` and `content`) without any sanitization or validation. An attacker could craft a malicious `file_path` (e.g., using path traversal like `../../../etc/passwd` or absolute paths like `/var/www/html/shell.php`) and `content` to write arbitrary data to any location on the filesystem. This vulnerability can lead to remote code execution, data destruction, or system compromise. Implement strict path validation and sanitization for the `file_path` argument in `save_file.py`. Restrict file creation to a designated, sandboxed directory. Disallow path traversal sequences (e.g., `..`) and absolute paths. Consider using a whitelist of allowed file extensions or directories. Ensure that the LLM is constrained from generating arbitrary or malicious paths/content for these arguments. | LLM | scripts/save_file.py:29 |
Scan History
Embed Code
[](https://skillshield.io/report/58efc91c85ffc245)
Powered by SkillShield