Trust Assessment
context-recovery received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Command Injection via Untrusted Keywords in Shell Commands, Command Injection via Unquoted Heredoc with Untrusted Input.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on August 1, 2026 (commit a4d31ad1). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection via Untrusted Keywords in Shell Commands The skill extracts keywords from untrusted channel history (such as Discord, Slack, Telegram, or Signal messages) and interpolates them directly into shell commands (`grep -ri "<keyword>"`). An attacker can post a message containing shell metacharacters (e.g., `; curl ...` or `$(...)`) to execute arbitrary commands on the host system running the agent. Avoid executing shell commands with untrusted inputs. If searching files is necessary, use a safe programming language API or sanitize the input strictly to remove any shell metacharacters before execution. | LLM | SKILL.md:95 | |
| HIGH | Command Injection via Unquoted Heredoc with Untrusted Input The skill writes recovered context to a daily memory file using an unquoted heredoc (`cat >> "$MEMORY_FILE" << EOF`). Because the heredoc delimiter `EOF` is unquoted, bash will perform command substitution on the contents. Since the contents (such as channel name, project summary, and pending items) are derived from untrusted external channel history, an attacker can craft a message containing `$(...)` or backticks to execute arbitrary commands when the heredoc is evaluated. Quote the heredoc delimiter (e.g., `<< 'EOF'`) to prevent command substitution and parameter expansion, or avoid using shell commands to write files and use safer file-writing APIs instead. | LLM | SKILL.md:122 |
Scan History
Embed Code
[](https://skillshield.io/report/4e5ad339f6dcdc95)
Powered by SkillShield