Security Audit

anysiteio/agent-skills:skills/anysite-competitor-analyzer

github.com/anysiteio/agent-skills

AI SkillCommit 34bedfab65ad

TRUSTED

Scanned 12 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

anysiteio/agent-skills:skills/anysite-competitor-analyzer received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 1 low severity. Key findings include Shell Injection Vulnerability in Command Template, Unnecessary Use of Dynamic Execution (exec).

The analysis covered 4 layers: dependency_graph, llm_behavioral_safety, manifest_analysis, static_code_analysis. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on February 8, 2026 (commit 34bedfab). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

100%

Dependency Graph

100%

LLM Behavioral Safety

83%

Behavioral Risk Signals

Network Access

1 finding

Shell Execution

2 findings

Dynamic Code

2 findings

Security Findings2

Severity	Finding	Layer	Location
HIGH	Shell Injection Vulnerability in Command Template The skill provides a bash command template that interpolates user inputs ('Competitor Name' and URL) directly into double-quoted strings. If the agent executes this command via a shell (as implied by the `bash` language hint) without proper sanitization, a malicious user could inject shell metacharacters (e.g., `"; malicious_cmd; "`) to execute arbitrary commands on the host system. Update the instructions to use Python's `subprocess.run` with a list of arguments instead of shell string interpolation, or ensure the agent uses a tool that handles argument escaping automatically.	Unknown	SKILL.md:30
LOW	Unnecessary Use of Dynamic Execution (exec) The Quick Start guide suggests a Python one-liner that uses `exec()` to import and run a function. While the provided string is static, encouraging the use of `exec` is a dangerous pattern that complicates security auditing and could be exploited if the command construction logic were modified to include user input. Refactor the Python one-liner to use standard import statements (e.g., `python -c "import sys, json; from scripts... import ..."`) instead of wrapping imports in `exec()`.	Unknown	SKILL.md:36

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/7a25e833c50856e6.svg)](https://skillshield.io/report/7a25e833c50856e6)