Security Audit
api-design-principles
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
api-design-principles received a trust score of 42/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Unsafe deserialization / dynamic eval, Insecure default for TrustedHostMiddleware, Insecure default for CORSMiddleware.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/api-design-principles/assets/rest-api-template.py:3 | |
| MEDIUM | Insecure default for TrustedHostMiddleware The `TrustedHostMiddleware` is configured with `allowed_hosts=["*"]`. While a `TODO` comment indicates this should be configured in production, providing a wildcard as a default in a template can lead to host header injection vulnerabilities if not properly configured before deployment. An attacker could potentially manipulate the Host header to point to a malicious domain, which could be used in various attacks like cache poisoning or password reset poisoning. Before deploying to production, replace `allowed_hosts=["*"]` with a specific list of trusted hostnames (e.g., `["api.example.com"]`). | LLM | assets/rest-api-template.py:22 | |
| MEDIUM | Insecure default for CORSMiddleware The `CORSMiddleware` is configured with `allow_origins=["*"]`. While a `TODO` comment indicates this should be updated in production, providing a wildcard as a default in a template can lead to Cross-Origin Resource Sharing (CORS) vulnerabilities. This allows any domain to make cross-origin requests to the API, potentially exposing sensitive data or allowing malicious sites to interact with the API on behalf of a user. Before deploying to production, replace `allow_origins=["*"]` with a specific list of allowed origins (e.g., `["https://yourfrontend.com"]`). If credentials are to be allowed (`allow_credentials=True`), it is critical to never use `"*"` for `allow_origins`. | LLM | assets/rest-api-template.py:28 |
Scan History
Embed Code
[](https://skillshield.io/report/e4169ada5f7dbdb1)
Powered by SkillShield