Security Audit
frankxai/claude-skills-library:free-skills/claude-sdk
github.com/frankxai/claude-skills-libraryTrust Assessment
frankxai/claude-skills-library:free-skills/claude-sdk received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Insecure Command Sanitization via Naive Blacklist.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on October 20, 2026 (commit 93c4aad5). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Insecure Command Sanitization via Naive Blacklist The `sanitize_bash_command` function implements a naive blacklist check to prevent dangerous shell commands. This approach is highly vulnerable to bypasses. For example, an attacker can bypass 'rm -rf' by inserting extra spaces ('rm -rf'), using alternative commands (e.g., 'shred', 'find . -delete'), or using shell execution techniques. Developers copying this code will be left with a false sense of security and vulnerable systems. Avoid using blacklists for command sanitization. Instead, use a strict whitelist of allowed commands, run commands in a sandboxed/containerized environment with restricted privileges, or avoid shell execution entirely by using structured APIs. | LLM | SKILL.md:340 |
Scan History
Embed Code
[](https://skillshield.io/report/04ccb7c651f95c62)
Powered by SkillShield