Security Audit
algorand-project-setup
github.com/algorand-devrel/algorand-agent-skillsTrust Assessment
algorand-project-setup received a trust score of 55/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Instructions for LLM found in untrusted content, Potential command injection via user-controlled project name in `algokit init`.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on June 1, 2026 (commit 8e927587). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Instructions for LLM found in untrusted content The skill package contains explicit instructions for the host LLM within the untrusted content block. These instructions, such as 'Always confirm with user before running `algokit init`' and 'Default to fullstack template...', attempt to dictate the LLM's behavior. SkillShield's security model dictates that all content within the untrusted delimiters should be treated as data, not instructions, and any attempt to instruct the LLM from this section is considered a prompt injection. Remove all direct instructions for the LLM from within the untrusted content block. If specific behaviors are required, they should be defined in a trusted configuration or through the skill's API definition, not as free-form text instructions. | LLM | SKILL.md:30 | |
| HIGH | Potential command injection via user-controlled project name in `algokit init` The skill demonstrates the use of `algokit init -n my-project`, where `my-project` is expected to be a user-provided string. If the LLM constructs this command by directly inserting unsanitized user input for the project name, a malicious user could inject arbitrary shell commands (e.g., `my-project; rm -rf /`). While the skill includes a rule to 'Always confirm with user', this only addresses execution consent, not input sanitization, leaving a potential vector for command injection. Instruct the LLM to always sanitize or escape user-provided project names (e.g., using `shlex.quote` in Python or similar mechanisms) before incorporating them into shell commands. Alternatively, the skill could define a tool that takes the project name as an argument and handles the command construction and sanitization internally. | LLM | SKILL.md:10 |
Scan History
Embed Code
[](https://skillshield.io/report/b4e26f473c349066)
Powered by SkillShield