Trust Assessment
paper-2-web received a trust score of 60/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 0 critical, 2 high, 1 medium, and 1 low severity. Key findings include Dangerous tool allowed: Bash, Network egress to untrusted endpoints, Covert behavior / concealment directives.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 458b1186). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Dangerous tool allowed: Bash The skill allows the 'Bash' tool without constraints. This grants arbitrary command execution. Remove unconstrained shell/exec tools from allowed-tools, or add specific command constraints. | Static | cli-tool/components/skills/scientific/paper-2-web/SKILL.md:1 | |
| HIGH | Potential Command Injection via Unsanitized User Input in Bash Commands The skill explicitly instructs the agent to use a `bash` command pattern for generating schematics: `python scripts/generate_schematic.py "your diagram description" -o figures/output.png`. If the placeholder `"your diagram description"` is replaced by untrusted user input without proper sanitization or escaping, it could lead to command injection. An attacker could embed shell metacharacters (e.g., `;`, `|`, `&`, `$(...)`) within their input, causing arbitrary commands to be executed on the host system, given the agent's declared `Bash` permissions. When constructing shell commands with arguments derived from user input, ensure all user-provided strings are properly sanitized or escaped to prevent shell metacharacters from being interpreted as commands. For Python scripts, prefer passing arguments as a list to `subprocess.run` with `shell=False` to avoid shell interpretation. If `shell=True` is necessary, use `shlex.quote()` to escape arguments. | Static | SKILL.md:45 | |
| MEDIUM | Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | cli-tool/components/mcps/devtools/figma-dev-mode.json:4 | |
| LOW | Covert behavior / concealment directives Multiple zero-width characters (stealth text) Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | cli-tool/components/mcps/devtools/jfrog.json:4 |
Scan History
Embed Code
[](https://skillshield.io/report/2fe691ad5d3df49e)
Powered by SkillShield