Security Audit
frankxai/claude-skills-library:free-skills/github-release-management
github.com/frankxai/claude-skills-libraryTrust Assessment
frankxai/claude-skills-library:free-skills/github-release-management received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Command Injection via Unquoted Tag Variable.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on October 20, 2026 (commit 93c4aad5). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via Unquoted Tag Variable The release script retrieves the last release tag using `gh release list` and stores it in the `LAST_TAG` variable. It then uses `${LAST_TAG}` unquoted in a subshell command. If an attacker creates a malicious tag containing shell metacharacters (e.g., `v1.0.0; curl ...`), it will result in arbitrary command execution when the script is run by the agent. Quote the `${LAST_TAG}` variable as `"${LAST_TAG}"` and validate that it matches a safe semantic version pattern (e.g., using a regex check) before using it in shell commands. | LLM | SKILL.md:71 |
Scan History
Embed Code
[](https://skillshield.io/report/d2d213b7467211e6)
Powered by SkillShield