An exciting type of data-integrated application based on Web is sprouting up all across the Internet, which is called Mashup application. At the same time, some new technologies and social challenges reveal themselves sequentially. This paper researches in Mashup application from a perspective of security, discusses how to assess the risks of Mashup application, and puts forward a risk evaluation model and some possible metrics for the actual assessment.