Trust Assessment
wavybaby received a trust score of 41/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 5 findings: 0 critical, 3 high, 2 medium, and 0 low severity. Key findings include Command Injection via User-Controlled Keywords in Skill Discovery, Supply Chain Risk via Dynamic Skill Installation from Untrusted Sources, Excessive Permissions Granted by Default Configuration.
The analysis covered 4 layers: manifest_analysis, llm_behavioral_safety, dependency_graph, static_code_analysis. The static_code_analysis layer scored lowest at 41/100, indicating areas for improvement.
Last analyzed on February 11, 2026 (commit 3572de0c). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via User-Controlled Keywords in Skill Discovery The skill explicitly instructs the agent to execute `npx skills find [keywords from task]`. If the `[keywords from task]` are derived directly from untrusted user input without proper sanitization, an attacker could inject shell metacharacters (e.g., `;`, `&&`, `|`) to execute arbitrary commands on the host system where the agent is running. Implement robust sanitization or escaping of user-provided keywords before incorporating them into shell commands. Consider using a safer API that does not directly concatenate user input into shell commands, or strictly validate input against an allow-list of characters. | Unknown | SKILL.md:30 | |
| HIGH | Supply Chain Risk via Dynamic Skill Installation from Untrusted Sources The skill instructs the agent to dynamically search for and install skills using `npx skills add <owner/repo> --skill <name>`. If `<owner/repo>` or `<name>` can be influenced by untrusted user input (e.g., from the task description), an attacker could trick the agent into installing malicious or vulnerable third-party skills from arbitrary repositories. The `-y` flag further exacerbates this by bypassing confirmation. Restrict skill installation to a predefined allow-list of trusted repositories and skill names. Implement strict validation and sanitization of `owner/repo` and `name` if they are derived from user input. Consider requiring explicit user confirmation for installing new skills, even with the `-y` flag, for critical environments. | Unknown | SKILL.md:33 | |
| HIGH | Excessive Permissions Granted by Default Configuration The skill instructs the agent to create `settings.local.json` with broad `Bash(*)` and `Skill(*)` permissions if the configuration is missing. This grants the agent extensive capabilities, including executing almost any shell command and accessing all available skills. This significantly increases the attack surface and the potential impact of other vulnerabilities like command injection or supply chain risks. Implement a principle of least privilege for default configurations. Only grant the minimum necessary permissions for the skill to function. Avoid wildcard permissions like `Bash(*)` and `Skill(*)` unless absolutely critical and with strong safeguards. Prompt the user for explicit confirmation before applying such broad permissions. | Unknown | SKILL.md:200 | |
| MEDIUM | Potential Data Exfiltration via Third-Party MCP Servers The skill instructs the agent to install several MCP servers (e.g., GitHub, Sentry, Notion) that use `http` transport to external third-party URLs. While this is their intended functionality, it means the agent will be connecting to and potentially sending data to these services. If the agent processes sensitive user data, there's a risk of this data being inadvertently or maliciously exfiltrated to these third-party services, depending on how the MCPs are used. Ensure that the agent is configured to handle sensitive data appropriately when interacting with third-party services. Provide clear warnings to users about data sharing implications when these MCPs are installed. Consider using secure transports (HTTPS) exclusively and verifying the authenticity of endpoints. | Unknown | SKILL.md:139 | |
| MEDIUM | Unconfirmed Software Installation via '-y' Flag The skill explicitly instructs the agent to install skills and MCP servers 'immediately' using the `-y` flag, which auto-confirms installation without user interaction. This reduces user control and increases the risk of installing unintended or malicious software, especially when combined with dynamic skill discovery or user-influenced package names. Remove or make the `-y` flag optional, requiring explicit user confirmation before installing new software. This provides a critical safeguard against unintended installations and malicious supply chain attacks. | Unknown | SKILL.md:35 |
Scan History
Embed Code
[](https://skillshield.io/report/44ba8d8b7634943e)
Powered by SkillShield