Security Audit
dceoy/speckit-agent-skills:skills/speckit-checklist
github.com/dceoy/speckit-agent-skillsTrust Assessment
dceoy/speckit-agent-skills:skills/speckit-checklist received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 1 critical, 1 high, 1 medium, and 0 low severity. Key findings include Direct Shell Script Execution with Potential Untrusted Input, Arbitrary File Read/Write due to Controllable FEATURE_DIR, Potential Data Corruption/Exfiltration via Checklist File Appending.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 48/100, indicating areas for improvement.
Last analyzed on April 1, 2026 (commit a934d48e). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Direct Shell Script Execution with Potential Untrusted Input The skill explicitly instructs the agent to run a shell script (`.specify/scripts/bash/check-prerequisites.sh`) from the repository root. The output of this script (FEATURE_DIR and AVAILABLE_DOCS) is then parsed and used in subsequent steps. The 'current feature' and 'scope' are derived from user input, which likely influences the script's execution or its output. This presents a significant command injection vulnerability, as an attacker could craft a prompt that manipulates the arguments passed to the script or the environment in which it runs, leading to arbitrary command execution. The instruction to handle single quotes in arguments further highlights the expectation of dynamic argument construction, increasing the risk. Avoid direct shell command execution based on user-influenced parameters. If external processing is required, use a sandboxed environment or a dedicated, secure API. Ensure all inputs to any external process are strictly validated and sanitized. Consider using a tool-specific function that abstracts the shell command and provides strict input validation. | LLM | SKILL.md:47 | |
| HIGH | Arbitrary File Read/Write due to Controllable FEATURE_DIR The `FEATURE_DIR` variable, derived from the output of the `check-prerequisites.sh` script (which is influenced by user input), is used to read `spec.md`, `plan.md`, `tasks.md` (Workflow Step 4) and to create directories (`FEATURE_DIR/checklists/`) and write checklist files within it (Workflow Step 5). If an attacker can manipulate the `FEATURE_DIR` value (e.g., by influencing the `check-prerequisites.sh` script's output through prompt injection), they could cause the agent to read arbitrary files from the filesystem (data exfiltration) or write files to arbitrary locations, potentially overwriting critical system files or injecting malicious content. The instruction 'All file paths must be absolute' prevents relative path traversal but does not prevent an attacker from specifying an absolute path to a sensitive location if they can control `FEATURE_DIR`. Strictly validate and sanitize `FEATURE_DIR` to ensure it points only to allowed, sandboxed locations. Implement a whitelist of allowed directories or use a virtualized filesystem. Ensure the `check-prerequisites.sh` script itself is secure and its output cannot be manipulated by untrusted input. The agent should not directly interpret arbitrary paths from script output without validation. | LLM | SKILL.md:47 | |
| MEDIUM | Potential Data Corruption/Exfiltration via Checklist File Appending Workflow step 5 states: 'If file exists, append to existing file'. If the `[domain].md` filename can be influenced by untrusted input (e.g., a prompt injection leading to a domain like `../../../../etc/passwd`), an attacker could cause the agent to append generated checklist content to arbitrary files on the system. This could lead to data corruption or, if the appended content contains sensitive information (even if generated by the LLM), a form of data exfiltration by modifying a file that is later read by another process. This instruction contradicts a later statement 'Each checklist run creates a NEW file (never overwrites existing checklists)', but the 'append' instruction is more specific and concerning. Ensure that the `domain` used for filenames is strictly whitelisted or sanitized to prevent path traversal or arbitrary file targeting. Clarify the behavior regarding existing files (append vs. new file) and enforce the safer option (always create new files in a controlled directory) within a sandboxed output location. | LLM | SKILL.md:115 |
Scan History
Embed Code
[](https://skillshield.io/report/47253456b72211cb)
Powered by SkillShield