Trust Assessment
xiaomi-air-purifier received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Unsafe deserialization / dynamic eval, Unpinned npm dependency version, Unpinned dependency in package.json.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unpinned dependency in package.json The `package.json` file specifies the `xmihome` dependency with a wildcard version (`*`). This means that any new version of `xmihome` will be installed, including potentially malicious or breaking changes, without explicit review. This introduces a significant supply chain risk, as a compromise of the `xmihome` package could directly impact the security of this skill. Pin the `xmihome` dependency to a specific major, minor, or patch version (e.g., `"xmihome": "^1.2.3"` or `"xmihome": "1.2.3"`) to ensure consistent and secure builds. Regularly review and update dependencies to mitigate known vulnerabilities. | LLM | package.json:9 | |
| MEDIUM | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/radyakaze/xiaomi-air-purifier/scripts/purifier.js:86 | |
| MEDIUM | Unpinned npm dependency version Dependency 'xmihome' is not pinned to an exact version ('*'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/radyakaze/xiaomi-air-purifier/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/fd1f4a7e10a87f1f)
Powered by SkillShield