Security Audit
ferminrp/agent-skills:skills/cafci-fondos-comunes-argentina
github.com/ferminrp/agent-skillsTrust Assessment
ferminrp/agent-skills:skills/cafci-fondos-comunes-argentina received a trust score of 70/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via `curl` and `jq` execution.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 24, 2026 (commit 84b0da63). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Potential Command Injection via `curl` and `jq` execution The skill explicitly instructs the agent to construct and execute shell commands using `curl -s "..." | jq '.'` with parameters derived from user input (e.g., fund names, dates, categories, etc.). If these user-provided values are not rigorously sanitized and shell-escaped before being interpolated into the command string, an attacker could inject arbitrary shell commands. For example, a malicious fund name could break out of the URL string and execute unintended commands on the host system. Avoid direct shell execution of commands constructed with user input. Instead, use a dedicated HTTP client library (e.g., Python's `requests`, Node.js `fetch`) to make API calls, which handles URL encoding and avoids shell interpretation. If `jq` is necessary for parsing, ensure its arguments are also sanitized and pass the HTTP client's output to `jq` via stdin, rather than chaining shell commands with user-controlled parts. | Static | SKILL.md:140 |
Scan History
Embed Code
[](https://skillshield.io/report/e9d32f149fc9a874)
Powered by SkillShield