compress-pdf

Trust Assessment

compress-pdf received a trust score of 69/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.

SkillShield's automated analysis identified 5 findings: 0 critical, 1 high, 2 medium, and 1 low severity. Key findings include Suspicious import: requests, Potential data exfiltration: file read + network send, Unpinned Python dependency version.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Layer Breakdown

Layer	Score
Manifest Analysis	100%
Static Code Analysis	78%
Dependency Graph	93%
LLM Behavioral Safety	98%

Behavioral Risk Signals

Network Access: 4 findings
Filesystem Write: 1 finding
Excessive Permissions: 1 finding

Security Findings 5

Severity	Finding	Layer	Location
HIGH	Potential data exfiltration: file read + network send Function 'create_job' reads files and sends data over the network. This may indicate data exfiltration. Review this function to ensure file contents are not sent to external servers.	Static	skills/crossservicesolutions/compress-pdf/scripts/compress-pdf.py:58
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/crossservicesolutions/compress-pdf/scripts/compress-pdf.py:24
MEDIUM	Unpinned Python dependency version Requirement 'requests>=2.32.0' is not pinned to an exact version. Pin Python dependencies with '=='.	Dependencies	skills/crossservicesolutions/compress-pdf/requirements.txt:1
LOW	Loosely pinned dependency 'requests' The 'requests' library is pinned with a minimum version (`requests>=2.32.0`) rather than an exact version (`requests==2.32.0`). Best practice for production environments is often to pin exact versions to ensure deterministic builds and prevent unexpected behavior.	LLM	requirements.txt:1
INFO	Suspicious provider name/domain 'XSS' The provider name 'Cross-Service-Solutions (XSS)' and its domain use the acronym 'XSS', which could be seen as a social engineering tactic. Investigate the legitimacy of the provider.	LLM	SKILL.md:1

Scan History

Score Trend

Date	Score
3 months ago	71
3 months ago	71
3 months ago	71
3 months ago	71
3 months ago	71
3 months ago	71
3 months ago	71
3 months ago	71
3 months ago	71
3 months ago	71
Latest	69

Embed Code

Markdown