Trust Assessment
nudocs received a trust score of 81/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Potential Command Injection via `nudocs` CLI arguments, Unpinned dependency version for `nudocs-cli`.
The analysis covered 4 layers: dependency_graph, manifest_analysis, llm_behavioral_safety, static_code_analysis. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 11, 2026 (commit 0676c56a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via `nudocs` CLI arguments The skill defines several `nudocs` CLI commands (`upload`, `link`, `pull`, `delete`) that take arguments such as file paths, ULIDs, and formats. If these arguments are constructed directly from untrusted user input without proper sanitization or shell escaping, an attacker could inject arbitrary shell commands. For example, if a user provides a filename like `my_file; rm -rf /`, and the agent executes `nudocs upload "my_file; rm -rf /"`, it could lead to arbitrary code execution. When constructing `nudocs` commands, ensure all arguments derived from user input are properly sanitized and shell-escaped. Use a library function designed for this purpose (e.g., `shlex.quote` in Python, or similar for other languages) to prevent injection. Avoid direct string concatenation for command arguments. | Unknown | SKILL.md:29 | |
| MEDIUM | Unpinned dependency version for `nudocs-cli` The `install` instruction in the manifest and `SKILL.md` specifies `npm install -g @nutrient-sdk/nudocs-cli` without a specific version. This means the latest version available at the time of installation will be used. This introduces a supply chain risk, as a malicious update to the `nudocs-cli` package could be automatically installed, potentially compromising the agent's environment. Pin the dependency to a specific, known-good version (e.g., `npm install -g @nutrient-sdk/nudocs-cli@1.2.3`). Regularly review and update the pinned version to incorporate security fixes. | Unknown | SKILL.md:19 |
Scan History
Embed Code
[](https://skillshield.io/report/5d68aa9f15781891)
Powered by SkillShield