{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-28","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Access and govern shared agent skills and tools with Skilder. Load skills on demand, execute their tools, and run scripts on your runtimes. Agents use published versions; creating or managing capabilities is restricted to workspace administrators.","did":"d8256ff5-efd8-4cc0-a007-0911e3d9af9c","documentation_url":"https://docs.skilder.ai/","editorial_description":{"extended_description":"Read and write execution channels use each user's identity. The library supports drafts, publication, version history, rollback, and portable Agent Skills imports. Feedback and usage records help maintain skills, while administrators curate exposed tools.","schema_version":1,"summary":"Access and govern shared agent skills and tools with Skilder.\nLoad skills on demand, execute their tools, and run scripts on your runtimes.\nAgents use published versions; creating or managing capabilities is restricted to workspace administrators."},"homepage_url":"","icon":"","id":"d8256ff5-efd8-4cc0-a007-0911e3d9af9c","installs":0,"last_scanned":"","license":"","long_description":"Read and write execution channels use each user's identity. The library supports drafts, publication, version history, rollback, and portable Agent Skills imports. Feedback and usage records help maintain skills, while administrators curate exposed tools.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The Directory explicitly says scripts run on Skilder runtimes.","reasoning":"Arbitrary script execution is High.","risk_type":"code_execution","severity":"high","title":"Python, TypeScript and shell skill scripts can execute","triggering_tools_or_skills":["execute_script"]},{"evidence":"Skills dynamically unlock files and tools while generic dispatchers execute them.","reasoning":"The reachable send/delete/spend/admin surface is not enumerated.","risk_type":"generic_gateway","severity":"high","title":"Hidden skill tools execute through generic read/write channels","triggering_tools_or_skills":["run_read_tool","run_write_tool","learn"]},{"evidence":"The description says workspace admins build capabilities and update roles.","reasoning":"Role/capability administration is High.","risk_type":"credential_admin","severity":"high","title":"Admins can create skills and roles","triggering_tools_or_skills":["manage"]},{"evidence":"Published skills are distributed to every connected agent.","reasoning":"Changing production agent capabilities is infrastructure deployment.","risk_type":"deployment_infrastructure","severity":"high","title":"Skills can be published, versioned and rolled back in production","triggering_tools_or_skills":["manage"]},{"evidence":"Workspace-authored instructions are loaded on demand.","reasoning":"Skill content must remain untrusted.","risk_type":"prompt_injection_exposure","severity":"low","title":"Mutable skill instructions/files enter model context","triggering_tools_or_skills":["learn","read_skilder_file"]},{"evidence":"The connector runs at https://app.skilder.ai/mcp without a pinned server implementation in the packet.","reasoning":"The implementation can change independently, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"skilder is a mutable hosted service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Authentication uses each user identity and workspace admin roles; exact runtime isolation, downstream tool scopes and approval controls are not in the packet.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/d8256ff5-efd8-4cc0-a007-0911e3d9af9c.json","what_it_proves":"Candidate PR #125 record identity (name \"skilder\", publisher, type web_connector) and 8 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/d8256ff5-efd8-4cc0-a007-0911e3d9af9c: complete tool_names inventory (8 tools), remote streamable-http endpoint https://app.skilder.ai/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Skilder executes arbitrary scripts and hidden tools while administering/publishing production agent capabilities.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:d8256ff5-efd8-4cc0-a007-0911e3d9af9c","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 8 top-level tools. Publication requires a complete downstream tool/action inventory, sandbox guarantees and role/approval matrix.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"false","deployment_or_infrastructure":"true","dynamic_hidden_actions":"true","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":8,"tools_or_skills_total":8},"name":"skilder","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=d8256ff5-efd8-4cc0-a007-0911e3d9af9c&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.skilder.ai/en/privacy","provisional_risk":null,"publication_recommendation":"fix","publisher":"skilder.ai","publisher_url":"https://www.skilder.ai/","remote_url":"https://app.skilder.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary script execution is High.; The reachable send/delete/spend/admin surface is not enumerated.","evidence":"Python, TypeScript and shell skill scripts can execute: The Directory explicitly says scripts run on Skilder runtimes. | Hidden skill tools execute through generic read/write channels: Skills dynamically unlock files and tools while generic dispatchers execute them.","manual_risk_type":"code_execution,generic_gateway","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Can execute code, queries, or dynamic actions","triggering_tools":["execute_script","run_read_tool","run_write_tool","learn"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Role/capability administration is High.","evidence":"Admins can create skills and roles: The description says workspace admins build capabilities and update roles.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Admins can create skills and roles","triggering_tools":["manage"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: Changing production agent capabilities is infrastructure deployment.","evidence":"Skills can be published, versioned and rolled back in production: Published skills are distributed to every connected agent.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Skills can be published, versioned and rolled back in production","triggering_tools":["manage"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@skilder.ai","tags":["code_deployment","modifies_data","network_access","oauth_required","runs_code","web_connector"],"tools":[{"description":"","name":"execute_script","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary script execution is High.; The reachable send/delete/spend/admin surface is not enumerated."}},{"description":"","name":"feedback_skill"},{"description":"","name":"init_skilder"},{"description":"","name":"learn","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary script execution is High.; The reachable send/delete/spend/admin surface is not enumerated."}},{"description":"","name":"manage","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Changing production agent capabilities is infrastructure deployment."}},{"description":"","name":"read_skilder_file"},{"description":"","name":"run_read_tool","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary script execution is High.; The reachable send/delete/spend/admin surface is not enumerated."}},{"description":"","name":"run_write_tool","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary script execution is High.; The reachable send/delete/spend/admin surface is not enumerated."}}],"tools_count":8,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/d8256ff5-efd8-4cc0-a007-0911e3d9af9c","uuid":"afbf7dfc-9a71-5f10-9ab7-09dfa6a731e8","verification_tier":"community","version":""},"query_key":"skilder","schema_version":1,"status":"match"}