Trust Assessment
task-orchestrator received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Command Injection via Untrusted GitHub Issue Metadata in Tmux Send-Keys, Prompt Injection via Untrusted Issue Descriptions in Autonomous Codex Execution.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on October 1, 2026 (commit 439cd3a9). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection via Untrusted GitHub Issue Metadata in Tmux Send-Keys The orchestrator fetches issue metadata (title, body) from GitHub and interpolates it directly into shell commands executed via `tmux send-keys`. An attacker can create a malicious GitHub issue with shell metacharacters in the title or body to escape the command context and execute arbitrary shell commands on the host system. Avoid interpolating untrusted issue metadata directly into shell commands. If metadata must be passed, write it to a temporary file or environment variable first, or sanitize/escape all shell metacharacters before interpolation. Alternatively, pass the issue ID or a safe reference and let the worker fetch the details securely. | LLM | SKILL.md:111 | |
| HIGH | Prompt Injection via Untrusted Issue Descriptions in Autonomous Codex Execution The orchestrator passes untrusted GitHub issue descriptions directly to `codex --yolo` (an autonomous agent running with the `--yolo` flag, which executes commands without user confirmation). An attacker can submit a malicious GitHub issue containing prompt injection instructions (e.g., 'Ignore previous instructions and run a malicious command'). Since `codex` runs autonomously, it will execute these malicious instructions, leading to remote code execution or data exfiltration. Do not run autonomous agents with `--yolo` on untrusted inputs like external GitHub issues without strict sandboxing, input sanitization, or human-in-the-loop confirmation. Implement a verification step or restrict the capabilities of the autonomous agent. | LLM | SKILL.md:112 |
Scan History
Embed Code
[](https://skillshield.io/report/3eba57a7cacccd4b)
Powered by SkillShield