Trust Assessment
ray-so-code-snippet received a trust score of 48/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 3 findings: 1 critical, 1 high, 1 medium, and 0 low severity. Key findings include Shell Command Injection via Python `urllib.parse.quote`, Supply Chain Risk from External CDN-hosted JavaScript Library, Potential Path Traversal in User-Specified Output Path.
The analysis covered 4 layers: dependency_graph, manifest_analysis, llm_behavioral_safety, static_code_analysis. The static_code_analysis layer scored lowest at 48/100, indicating areas for improvement.
Last analyzed on February 11, 2026 (commit 326f2466). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Shell Command Injection via Python `urllib.parse.quote` The skill constructs shell commands using `python3 -c` to URL-encode user-provided data (code and potentially title). The user input is embedded directly into a single-quoted string within the Python command. If the user's code or title contains a single quote, it will break out of the Python string, allowing arbitrary shell commands to be injected and executed on the host system. This is a classic command injection vulnerability. Modify the Python command to pass the user-provided string as an argument, rather than embedding it directly into the Python script string. For example, use `python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1]))' "$CODE_BASE64"`. This ensures the input is treated as a literal string argument by Python, preventing shell injection. | Unknown | SKILL.md:140 | |
| HIGH | Supply Chain Risk from External CDN-hosted JavaScript Library The skill instructs `agent-browser` to load the `html-to-image` JavaScript library from `https://cdn.jsdelivr.net/npm/html-to-image@1.11.11/dist/html-to-image.js`. Relying on an external CDN introduces a supply chain risk. If `cdn.jsdelivr.net` were compromised, or if the `html-to-image` package itself were maliciously altered, arbitrary JavaScript could be executed within the `agent-browser`'s context. This could lead to data exfiltration, browser-based attacks, or other malicious activities. To mitigate this risk, consider vendoring the `html-to-image` library locally if possible, or implement Subresource Integrity (SRI) if the `agent-browser` environment supports it. SRI would ensure that the fetched script's content matches a known cryptographic hash, preventing execution of tampered scripts. | Unknown | SKILL.md:170 | |
| MEDIUM | Potential Path Traversal in User-Specified Output Path The skill notes that it will 'Only use a different path if the user explicitly specifies one in their original request' for saving the output image. If the user-provided path is not rigorously sanitized and validated by the agent, it could be vulnerable to path traversal attacks (e.g., `../../../../etc/passwd`). This could allow an attacker to write files to arbitrary locations on the filesystem, potentially overwriting critical system files or placing malicious content. Implement strict validation and sanitization for any user-provided output file paths. Ensure that paths are canonicalized and restricted to a designated safe directory (e.g., a temporary directory or a user-specific output folder) to prevent path traversal and arbitrary file writes. | Unknown | SKILL.md:110 |
Scan History
Embed Code
[](https://skillshield.io/report/d639111e74b3f709)
Powered by SkillShield