Trust Assessment
terraform-search-import received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include Command Injection via unsanitized user input in shell script, Command Injection via unsanitized user input in shell script (echo command).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on June 1, 2026 (commit 339a1139). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via unsanitized user input in shell script The `scripts/list_resources.sh` script directly embeds the user-provided `$PROVIDER` variable into a double-quoted string argument for the `jq` command. If `$PROVIDER` contains shell metacharacters like `$(command)` or backticks, the shell will execute the embedded command before passing the argument to `jq`. This allows for arbitrary command execution by a malicious user providing a crafted provider name. To prevent command injection, pass user-controlled variables to `jq` using the `--arg` or `--argjson` options. This ensures `jq` treats the variable's content as a literal string, preventing shell expansion. For example, replace `"{"$PROVIDER": ...}"` with `jq --arg provider_name "$PROVIDER" '{$provider_name: ...}'`. | LLM | scripts/list_resources.sh:29 | |
| HIGH | Command Injection via unsanitized user input in shell script (echo command) Similar to the `jq` command, the `echo` command also directly embeds the user-provided `$PROVIDER` variable into a double-quoted string. If `$PROVIDER` contains shell metacharacters like `$(command)` or backticks, the shell will execute the embedded command before `echo` processes the string. This allows for arbitrary command execution. To prevent command injection, avoid directly embedding user input into double-quoted strings that are subject to shell expansion. For JSON output, use `jq -n --arg provider_name "$PROVIDER" '{$provider_name: []}'` instead of `echo` to safely construct the JSON string. | LLM | scripts/list_resources.sh:33 |
Scan History
Embed Code
[](https://skillshield.io/report/8445d381e0fca7f5)
Powered by SkillShield