Security Audit
existential-birds/beagle:plugins/beagle-docs/skills/humanize-beagle
github.com/existential-birds/beagleTrust Assessment
existential-birds/beagle:plugins/beagle-docs/skills/humanize-beagle received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Command Injection via Unsanitized File Paths in Validation Steps.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on July 20, 2026 (commit aed6fce7). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via Unsanitized File Paths in Validation Steps The skill instructions direct the LLM to execute shell commands (such as `grep`, `python3 -c`, `npx -y acorn`, and `git checkout`) using the `$file` variable, which is derived from the untrusted `.beagle/ai-writing-review.json` file. If a malicious repository contains crafted file paths with shell metacharacters (e.g., `; malicious_command`), it can lead to arbitrary command execution on the user's system. Avoid executing shell commands with unsanitized variables extracted from untrusted files. Use built-in LLM tools or sanitize the file paths to ensure they only contain valid relative paths without shell metacharacters. | LLM | SKILL.md:182 |
Scan History
Embed Code
[](https://skillshield.io/report/e93b7e701606dc67)
Powered by SkillShield