Security Audit
frankxai/claude-skills-library:.grok/skills/multi-harness-orchestrator
github.com/frankxai/claude-skills-libraryTrust Assessment
frankxai/claude-skills-library:.grok/skills/multi-harness-orchestrator received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Command Injection via Automatic Shell Execution of Untrusted Inputs.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on October 20, 2026 (commit 93c4aad5). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via Automatic Shell Execution of Untrusted Inputs The skill manifest instructs the agent to automatically execute shell commands ('Auto-utilize by shelling harness CLIs') using parameters derived from tasks and rules ('injected rules + task'). If these tasks or rules contain untrusted input (e.g., from a repository file, issue, or PR), it can lead to arbitrary command execution on the host system. Avoid automatic execution of shell commands constructed from untrusted or dynamic inputs. If delegation is necessary, use safe APIs or require explicit user confirmation before executing any shell commands. Ensure all inputs are strictly validated and sanitized. | LLM | SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/5eb1213a2d5eef38)
Powered by SkillShield