Trust Assessment
spidey received a trust score of 18/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 4 findings: 2 critical, 1 high, 1 medium, and 0 low severity. Key findings include Command Injection via unsanitized user argument, Supply Chain Risk and Command Injection via unpinned git clone and arbitrary script execution, Excessive Permissions granted to agent via 'Bash(*)' wildcard in ALLOWED_TOOLS.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 18/100, indicating areas for improvement.
Last analyzed on June 1, 2026 (commit e47452f4). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection via unsanitized user argument The skill directly assigns the user-provided `$ARGUMENTS` to the `PROJECT_NAME` variable within a shell context (`PROJECT_NAME="$ARGUMENTS"`). This allows for classic shell command injection. An attacker could craft `$ARGUMENTS` to include shell metacharacters (e.g., `"; rm -rf /;"`) leading to arbitrary command execution on the host system. Sanitize the `$ARGUMENTS` input before using it in a shell command. For example, use `printf -v PROJECT_NAME '%s' "$ARGUMENTS"` to safely assign the value, or ensure that any subsequent use of `$PROJECT_NAME` is properly quoted and escaped for the context it's used in. | Static | SKILL.md:195 | |
| CRITICAL | Supply Chain Risk and Command Injection via unpinned git clone and arbitrary script execution The skill clones an external Git repository (`https://github.com/frankbria/ralph-claude-code.git`) without pinning it to a specific commit hash or tag. Immediately after cloning, it executes `./install.sh` from within the cloned repository. This introduces a critical supply chain risk: if the `frankbria/ralph-claude-code` repository is compromised, or if a malicious change is introduced to its `main` branch, the skill would download and execute arbitrary malicious code on the host system. Pin the `git clone` operation to a specific, known-good commit hash or tag to ensure deterministic and secure dependency fetching. Thoroughly review the contents of `install.sh` and consider sandboxing its execution or replacing it with explicit, controlled commands within the skill. | Static | SKILL.md:170 | |
| HIGH | Excessive Permissions granted to agent via 'Bash(*)' wildcard in ALLOWED_TOOLS The skill configures the Ralph agent with `ALLOWED_TOOLS` that include broad `Bash` execution permissions using a wildcard (e.g., `Bash(git *)`, `Bash(npm *)`, `Bash(docker *)`). The `*` wildcard allows the agent to execute any command with these prefixes and any arguments. This grants the agent significant control over the host system's shell, enabling it to perform arbitrary actions. Specifically, `Bash(docker *)` is highly dangerous as it could allow the agent to run arbitrary containers, potentially with host access, leading to container escape or arbitrary code execution on the host. Restrict `Bash` tool arguments to a very specific allowlist of commands and arguments, or remove `Bash` tools entirely if not strictly necessary. Avoid `Bash(docker *)` unless absolutely critical and implemented with extreme sandboxing and strict argument validation. | Static | SKILL.md:200 | |
| MEDIUM | Supply Chain Risk via system package installation with elevated privileges The skill instructs the installation of system-level packages (`jq`, `tmux`, `coreutils`) using `brew` (macOS) and `sudo apt install` (Linux). While these are common utilities, installing packages from external repositories introduces a supply chain risk. A compromised package repository or a typosquatted package name could lead to the installation of malicious software. The use of `sudo` implies elevated privileges, increasing the potential impact of such a compromise. Verify the integrity of packages before installation. Consider using a more controlled environment with pre-installed dependencies or explicitly state the risks associated with installing system packages from external sources. Ensure package names are correct and not typosquats. | Static | SKILL.md:175 |
Scan History
Embed Code
[](https://skillshield.io/report/6beb573ea29b6ea8)
Powered by SkillShield