Trust Assessment
task-orchestrator received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Indirect Prompt Injection via Untrusted GitHub Issue Content, Command Injection via Unsanitized Log Interpolation in Tmux.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on August 1, 2026 (commit a4d31ad1). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Indirect Prompt Injection via Untrusted GitHub Issue Content The skill orchestrates tasks by fetching open GitHub issues and passing their descriptions directly to Codex with the '--yolo' flag (autonomous execution). Since anyone can open a GitHub issue on a public repository, an attacker can craft an issue containing prompt injection instructions. When processed, Codex will execute these instructions autonomously, potentially leading to arbitrary code execution, data exfiltration, or credential theft. Avoid running LLM agents in autonomous/YOLO mode on untrusted inputs like public GitHub issues without human-in-the-loop approval. Implement strict input validation, sanitization, and safety filtering on issue descriptions before passing them to the model. | LLM | SKILL.md:114 | |
| HIGH | Command Injection via Unsanitized Log Interpolation in Tmux The self-healing routine captures the last 20 lines of 'error.log' and interpolates them directly into a double-quoted string passed to 'tmux send-keys'. If the error log contains single quotes or shell metacharacters (which can be controlled by an attacker via failing test outputs or malicious files), it will break out of the single-quoted argument in the tmux shell, leading to arbitrary command execution on the host system. Do not interpolate raw file contents or untrusted logs directly into shell commands or tmux send-keys arguments. Instead, write the error context to a temporary file and have the agent read it from within the sandbox, or properly escape all shell metacharacters before passing them to tmux. | LLM | SKILL.md:173 |
Scan History
Embed Code
[](https://skillshield.io/report/3eba57a7cacccd4b)
Powered by SkillShield