Security Audit
freshservice-automation
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
freshservice-automation received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 0 critical, 1 high, 2 medium, and 1 low severity. Key findings include Direct Email Sending Capability via Freshservice API, Potential for Unauthorized Service Request Creation, HTML Injection Capability in Ticket/Email Descriptions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 69/100, indicating areas for improvement.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Direct Email Sending Capability via Freshservice API The `FRESHSERVICE_CREATE_TICKET_OUTBOUND_EMAIL` tool allows the AI agent to send emails with arbitrary subjects, HTML descriptions, and to specified `cc_emails`. This presents a significant risk for data exfiltration, as sensitive information could be sent to unauthorized external email addresses if the agent is compromised via prompt injection. It also represents an excessive permission if not strictly controlled, potentially allowing for spam or phishing campaigns. Implement strict guardrails and human-in-the-loop approval for any outbound email actions. Restrict `cc_emails` to internal or pre-approved domains. Ensure the `email_config_id` parameter is tightly controlled and cannot be arbitrarily chosen by the agent. Monitor email sending activity for anomalies. | LLM | SKILL.md:127 | |
| MEDIUM | Potential for Unauthorized Service Request Creation The `FRESHSERVICE_CREATE_SERVICE_REQUEST` tool allows the AI agent to submit service requests for catalog items using `item_display_id`. Depending on the nature of these catalog items (e.g., provisioning cloud resources, ordering physical assets, granting access), this capability could lead to unauthorized resource consumption, financial costs, or security breaches if the agent is prompted to create requests for sensitive items without proper authorization. The ability to specify `custom_fields` further increases the potential for misuse. Implement strict validation and authorization mechanisms for `item_display_id` to ensure the agent can only request approved and non-sensitive catalog items. Consider a human-in-the-loop approval process for service requests that incur costs or grant significant access. Regularly review the scope of items accessible via this tool. | LLM | SKILL.md:154 | |
| MEDIUM | HTML Injection Capability in Ticket/Email Descriptions Several tools (`FRESHSERVICE_CREATE_TICKET`, `FRESHSERVICE_BULK_UPDATE_TICKETS`, `FRESHSERVICE_CREATE_TICKET_OUTBOUND_EMAIL`) explicitly allow HTML content in the `description` or email body parameters. While intended for rich text formatting within Freshservice, a compromised AI agent could be prompted to inject malicious HTML (e.g., JavaScript) which, if not properly sanitized by Freshservice's UI when displayed to human users, could lead to Cross-Site Scripting (XSS) vulnerabilities. This allows an attacker to manipulate the content or behavior of the Freshservice interface for other users. Ensure Freshservice's user interface rigorously sanitizes all HTML content submitted via API calls before rendering it to users. Instruct the AI agent to generate only safe, limited HTML or prefer plain text for descriptions unless rich formatting is explicitly required and validated. | LLM | SKILL.md:86 | |
| LOW | Retrieval of Potentially Sensitive Ticket Data The `FRESHSERVICE_LIST_TICKETS` and `FRESHSERVICE_GET_TICKET` tools allow the retrieval of detailed ticket information, including `description` and `conversations`. These fields can contain sensitive user data, internal discussions, or confidential information. While this is the intended functionality of an ITSM tool, the AI agent must be carefully managed to prevent unauthorized disclosure of this data to end-users or other systems if compromised by prompt injection. Implement strict access controls and data redaction policies for AI agent outputs that involve sensitive ticket data. Ensure the agent's responses are carefully filtered and do not inadvertently expose confidential information. Train the agent to ask for explicit user consent before revealing sensitive details. | LLM | SKILL.md:50 |
Scan History
Embed Code
[](https://skillshield.io/report/7cc51be8b0036599)
Powered by SkillShield