Security Audit
ferminrp/agent-skills:skills/riesgo-pais-argentina
github.com/ferminrp/agent-skillsTrust Assessment
ferminrp/agent-skills:skills/riesgo-pais-argentina received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential `jq` Command Injection via User-Controlled Date Filters.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 24, 2026 (commit 84b0da63). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential `jq` Command Injection via User-Controlled Date Filters The skill's workflow explicitly states that if a user requests a specific period, the data will be filtered locally using `jq` based on the `fecha` (date) field. The example provided shows a `jq` command like `jq '.data.datos | map(select(.fecha >= "2025-01-01" and .fecha <= "2025-12-31"))'`. If the date values (e.g., "2025-01-01", "2025-12-31") are directly incorporated from untrusted user input without proper sanitization or escaping, a malicious user could inject arbitrary `jq` expressions. This could lead to information disclosure, denial of service, or potentially arbitrary command execution depending on the `jq` version and environment where the skill is executed. Implement robust input sanitization and escaping for any user-provided values (like dates) before incorporating them into `jq` commands. Ideally, use a dedicated JSON parsing library in the agent's runtime to filter data programmatically rather than relying on shell-based `jq` execution with user-controlled arguments. If `jq` must be used, ensure all user input is strictly validated against expected date formats and properly quoted/escaped to prevent injection. | LLM | SKILL.md:39 |
Scan History
Embed Code
[](https://skillshield.io/report/ed1afc1d1e617c2e)
Powered by SkillShield