Trust Assessment
zohocl received a trust score of 77/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 4 findings: 0 critical, 0 high, 3 medium, and 1 low severity. Key findings include Unsafe deserialization / dynamic eval, Missing required field: name, Node lockfile missing.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/senthazalravi/zohocl/index.js:6 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/senthazalravi/zohocl/SKILL.md:1 | |
| MEDIUM | Excessive API Permissions Encouraged The skill's setup instructions in `SKILL.md` explicitly recommend generating a Zoho API client with the `ZohoCRM.modules.ALL` scope. This grants very broad access to all CRM modules. Furthermore, the `index.js` skill implements a wide range of functionalities across multiple Zoho products (CRM, Books, Desk, Creator, Campaigns). If the skill's actual intended use case is narrower than the full scope of these products, granting such extensive permissions increases the attack surface and potential impact in case of a security compromise. Users should be encouraged to follow the principle of least privilege. Modify the setup instructions to advise users to request only the minimum necessary API scopes required for the skill's specific functionality. Provide examples of more granular scopes if applicable, or clearly state the full range of permissions the skill *actually* utilizes. | LLM | SKILL.md:56 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/senthazalravi/zohocl/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/ec24c2f8bceedc0a)
Powered by SkillShield