Trust Assessment
vestaboard received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Unpinned npm dependency version, Arbitrary File Read and Exfiltration, Excessive File System Read Permissions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Read and Exfiltration The `vbWriteLayout` function in `scripts/vb.js` directly uses a user-provided path from command-line arguments (`process.argv`) to read arbitrary files from the filesystem using `readFileSync`. The content of this file is then included in the body of a POST request to the Vestaboard Cloud API. This allows an attacker to read any file accessible by the skill's process (e.g., `/etc/passwd`, `~/.ssh/id_rsa`, configuration files) and exfiltrate its contents to an external service. Implement strict path validation and sanitization for the `path` argument in `vbWriteLayout`. Restrict file access to a specific, sandboxed directory (e.g., `content/layouts/`) and prevent directory traversal attacks (e.g., `../`). Only allow reading files from trusted, predefined locations. | LLM | scripts/vb.js:109 | |
| MEDIUM | Unpinned npm dependency version Dependency 'undici' is not pinned to an exact version ('^7.3.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/seidprojects/vestaboard/package.json | |
| MEDIUM | Excessive File System Read Permissions The `vbWriteLayout` function grants excessive file system read permissions by allowing the skill to read any file specified by a user-provided path. This broad access is not necessary for the stated purpose of writing Vestaboard layouts, which should ideally be restricted to a specific set of known layout files or a dedicated directory. Limit the scope of file system access. Instead of accepting arbitrary paths, validate that the provided path refers to a file within an allowed, sandboxed directory (e.g., `content/layouts/`) and sanitize the path to prevent directory traversal. Consider using a whitelist of allowed files if the layouts are static. | LLM | scripts/vb.js:109 |
Scan History
Embed Code
[](https://skillshield.io/report/112e17f664edec8f)
Powered by SkillShield