Security Audit
existential-birds/beagle:plugins/beagle-core/skills/gen-release-notes
github.com/existential-birds/beagleTrust Assessment
existential-birds/beagle:plugins/beagle-core/skills/gen-release-notes received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Command Injection via Unsanitized Arguments.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on July 20, 2026 (commit aed6fce7). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via Unsanitized Arguments The skill accepts user-controlled input via `$ARGUMENTS` and directly interpolates it into shell commands (such as `git tag -l "$PREV_TAG"`, `git log ${PREV_TAG}..HEAD`, and `gh pr list ... $PREV_TAG`) without prior validation or sanitization. A maliciously crafted tag name containing shell metacharacters (e.g., `; command ;`) could lead to arbitrary command execution in the host environment. Validate that `$ARGUMENTS` matches a safe pattern (such as a semantic version tag like `v[0-9]+\.[0-9]+\.[0-9]+` or a valid git ref format) before using it in shell commands. Avoid direct shell interpolation of unsanitized user input. | LLM | SKILL.md:32 |
Scan History
Embed Code
[](https://skillshield.io/report/57cb7dd99ced1248)
Powered by SkillShield