Trust Assessment
codenavi received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 1 critical, 1 high, 1 medium, and 0 low severity. Key findings include Direct Command and Code Execution Capability, Potential Data Exfiltration via External Services (Web Search, MCPs), Broad File System Access Permissions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 48/100, indicating areas for improvement.
Last analyzed on June 1, 2026 (commit 81e7e0dd). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Direct Command and Code Execution Capability The skill explicitly states its ability to use 'bash commands' and 'code execution'. If the agent constructs these commands or code snippets using untrusted input (e.g., user input, file contents from an unknown codebase), it creates a severe command injection vulnerability. An attacker could craft input that leads to arbitrary code execution on the host system. Implement strict sandboxing for all command and code execution. Ensure that any arguments or code passed to 'bash commands' or 'code execution' are thoroughly sanitized and validated, especially if derived from untrusted sources. Consider using a allowlist approach for commands and arguments. | LLM | SKILL.md:180 | |
| HIGH | Potential Data Exfiltration via External Services (Web Search, MCPs) The skill is designed to read and understand arbitrary code from the project. It is also instructed to use 'Web search' and 'MCP Context7' for documentation and information. If sensitive information (e.g., API keys, PII, internal system details) read from the codebase is inadvertently or maliciously included in queries sent to these external services, it could lead to data exfiltration. While the skill has a rule 'Pointers, not copies' for its internal notebook, this does not apply to external queries. Implement strict sanitization and filtering of all data before it is sent to external services like web search or MCPs. Ensure that no sensitive information from the codebase (e.g., secrets, PII, internal file paths) is included in these external queries. Explicitly instruct the agent to redact or generalize sensitive details before querying external sources. | LLM | SKILL.md:168 | |
| MEDIUM | Broad File System Access Permissions The skill requires broad read access to the entire project codebase to 'investigate the relevant parts' and 'trace the flow'. It also requires write access to the `.notebook/` directory to maintain its knowledge base. While necessary for its intended function, this broad access increases the attack surface. A compromised agent could potentially read or modify any file within the project directory, or write malicious content to the `.notebook/` that could later be executed or misinterpreted. If possible, restrict file system access to only the directories and file types strictly necessary for the skill's operation. Implement file system access controls (e.g., allowlists for paths, read-only access where write is not needed). Monitor file system interactions for anomalous behavior. | LLM | SKILL.md:100 |
Scan History
Embed Code
[](https://skillshield.io/report/4571f35d18d8d6e6)
Powered by SkillShield