Trust Assessment
auto-status received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Potential Command Injection via unsanitized arguments to shell script.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 15, 2026 (commit 1823c3f6). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via unsanitized arguments to shell script The skill executes a `bash` script (`plugins/specweave/scripts/auto-status.sh`) and passes user-provided arguments (`[args]`) directly to it. If these arguments, which can be controlled by the user (e.g., `--json`, `--simple`), are not properly sanitized, validated, and escaped within the `auto-status.sh` script, a malicious user could inject arbitrary shell commands. This could lead to remote code execution within the agent's environment, allowing for data exfiltration, system modification, or other unauthorized actions. Review the `plugins/specweave/scripts/auto-status.sh` script to ensure all user-provided arguments are strictly validated and sanitized. Implement robust input validation, use `getopt` or similar mechanisms for parsing options, and always quote variables when used in shell commands to prevent arbitrary command injection. Consider using a whitelist approach for allowed arguments and values. | LLM | SKILL.md:52 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | plugins/specweave/skills/auto-status/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/c7bff03a86586bd6)
Powered by SkillShield