Security Audit
coda-automation
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
coda-automation received a trust score of 81/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Document Export Capability Enables Data Exfiltration, Tools Granting/Modifying Document Permissions and Public Access.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Tools Granting/Modifying Document Permissions and Public Access The skill provides access to tools such as `CODA_ADD_PERMISSION` and `CODA_PUBLISH_DOC`. These tools can modify document access control lists, grant new permissions to users (including 'write' access), and publish documents publicly. Misuse of these tools, potentially via a malicious prompt, could lead to unauthorized access, data leakage, or public exposure of sensitive Coda documents. Implement strict authorization checks and user confirmation for any operations that modify document permissions or public visibility. The LLM should be explicitly instructed to never alter permissions or publish documents without explicit, verified user intent. | LLM | SKILL.md:169 | |
| MEDIUM | Document Export Capability Enables Data Exfiltration The skill exposes `CODA_BEGIN_CONTENT_EXPORT` and `CODA_CONTENT_EXPORT_STATUS` tools, which allow exporting Coda document content (HTML or Markdown). This capability, if triggered by a malicious or unconstrained prompt, could lead to the exfiltration of sensitive document data. The skill provides the mechanism to generate a temporary download URL for document content. Implement strict access controls and user confirmation for document export operations. Ensure the LLM is explicitly instructed to never export sensitive documents without explicit user consent and verification. | LLM | SKILL.md:140 |
Scan History
Embed Code
[](https://skillshield.io/report/f6a2c3e3c6d4a5c4)
Powered by SkillShield