Trust Assessment
skill-installer received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 8 findings: 3 critical, 4 high, 1 medium, and 0 low severity. Key findings include Unsafe environment variable passthrough, Arbitrary command execution, Credential harvesting.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 25/100, indicating areas for improvement.
Last analyzed on February 16, 2026 (commit ccf6204f). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings8
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skill-installer/scripts/install-skill-from-github.py:100 | |
| CRITICAL | Credential harvesting Reading well-known credential environment variables Skills should only access environment variables they explicitly need. Bulk environment dumps (os.environ.copy, JSON.stringify(process.env)) are almost always malicious. Remove access to Keychain, GPG keys, and credential stores. | Manifest | skill-installer/scripts/github_utils.py:12 | |
| CRITICAL | Command Injection via Git Argument Injection (git clone) The `_build_repo_url` and `_build_repo_ssh` functions construct the repository URL using f-strings with user-provided `owner` and `repo` values. If these values contain spaces or Git options (e.g., `--upload-pack=...`), they can be interpreted as separate arguments by the `git clone` command, leading to arbitrary command execution. For example, a malicious `repo` value like `malicious/repo --upload-pack=exec /bin/sh -c 'echo PWNED > /tmp/pwned'` would result in `git clone` executing the provided shell command. Strictly validate `owner` and `repo` inputs to ensure they do not contain spaces, leading hyphens, or other characters that could be interpreted as Git options. A robust solution would involve whitelisting allowed characters (e.g., alphanumeric, hyphens, underscores) and rejecting any input that deviates. Alternatively, use a Git client library that handles URL and argument escaping safely. | Static | scripts/install-skill-from-github.py:209 | |
| HIGH | Unsafe environment variable passthrough Access to well-known credential environment variables Minimize environment variable exposure. Only pass required, non-sensitive variables to MCP servers. Use dedicated secret management instead of environment passthrough. | Manifest | skill-installer/scripts/github_utils.py:12 | |
| HIGH | Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function '_run_git'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skill-installer/scripts/install-skill-from-github.py:100 | |
| HIGH | Command Injection via Git Argument Injection (git sparse-checkout set) The `_git_sparse_checkout` function passes user-provided `paths` directly to `git sparse-checkout set`. If a path in `paths` starts with a hyphen (`-`), Git may interpret it as an option rather than a pathspec. While `_validate_relative_path` prevents path traversal, it does not prevent argument injection. A malicious user could provide a path like `--option=value` or similar, potentially altering Git's behavior or exploiting other Git vulnerabilities. When passing user-controlled pathspecs to `git sparse-checkout set`, use the `--` separator to explicitly mark the end of options and the beginning of pathspecs. For example, `_run_git(["git", "-C", repo_dir, "sparse-checkout", "set", "--", *paths])`. Additionally, validate that user-provided paths do not start with hyphens, even with the `--` separator, as a defense-in-depth measure. | Static | scripts/install-skill-from-github.py:169 | |
| HIGH | LLM analysis found no issues despite critical deterministic findings Deterministic layers flagged 3 CRITICAL findings, but LLM semantic analysis returned clean. This may indicate prompt injection or analysis evasion. | LLM | (sanity check) | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skill-installer/scripts/github_utils.py:7 |
Scan History
Embed Code
[](https://skillshield.io/report/ff04b439c9d10777)
Powered by SkillShield