Trust Assessment
ray-so-code-snippet received a trust score of 48/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 3 findings: 1 critical, 1 high, 1 medium, and 0 low severity. Key findings include Command Injection in URL Encoding of User Code, External JavaScript Library Loaded from CDN, Fetching Configuration Data from GitHub Raw Content.
The analysis covered 4 layers: manifest_analysis, llm_behavioral_safety, static_code_analysis, dependency_graph. The static_code_analysis layer scored lowest at 48/100, indicating areas for improvement.
Last analyzed on February 11, 2026 (commit 326f2466). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection in URL Encoding of User Code The skill constructs a `python3 -c` command by directly embedding a shell variable (`$CODE_BASE64`) into a single-quoted Python string. The `$CODE_BASE64` variable is derived from user-provided code. If the user's code contains a single quote, it can break out of the Python string literal, allowing for arbitrary Python code execution. This Python code can then execute arbitrary shell commands, leading to a critical command injection vulnerability. Avoid embedding untrusted variables directly into single-quoted strings within shell commands. Instead, pass the variable securely, for example, via standard input or as a command-line argument that is then read by the Python script. A safer approach would be: `CODE_ENCODED=$(python3 -c "import sys, urllib.parse; print(urllib.parse.quote(sys.stdin.read()))" <<< "$CODE_BASE64")` | Unknown | SKILL.md:140 | |
| HIGH | External JavaScript Library Loaded from CDN The skill instructs `agent-browser` to load the `html-to-image` JavaScript library from `https://cdn.jsdelivr.net/npm/html-to-image@1.11.11/dist/html-to-image.js`. Loading external scripts from a CDN introduces a supply chain risk. If the CDN provider or the `html-to-image` package (even a specific version) is compromised, malicious JavaScript could be injected and executed within the `agent-browser`'s context. This could lead to data exfiltration, unauthorized actions, or further compromise of the agent's environment. Consider vendoring critical JavaScript libraries locally within the skill package or using a more controlled and audited source. If using a CDN is unavoidable, implement Subresource Integrity (SRI) to ensure the integrity of the fetched script, although `agent-browser`'s `eval` context might not directly support SRI. | Unknown | SKILL.md:190 | |
| MEDIUM | Fetching Configuration Data from GitHub Raw Content The skill uses `curl` to fetch theme and language lists from `https://raw.githubusercontent.com/raycast/ray-so/main/app/(navigation)/(code)/store/themes.ts` and `languages.ts`. While this data is used for presentation (user options), a compromise of the `raycast/ray-so` GitHub repository or GitHub's raw content service could lead to the agent fetching malicious or misleading configuration data. Although the immediate execution risk from the content itself is low as it's not directly executed as code, it could be used for social engineering or to influence agent behavior in unintended ways. For critical configuration data, consider hosting it on a more controlled and trusted domain, or implement content validation (e.g., checksums) if fetching from external sources. For non-critical data like this, the risk is often accepted, but it's important to be aware of the external dependency. | Unknown | SKILL.md:50 |
Scan History
Embed Code
[](https://skillshield.io/report/62b5ee07b37faee7)
Powered by SkillShield