Security Audit
KAOPU-XiaoPu/web-design:root
github.com/KAOPU-XiaoPu/web-designTrust Assessment
KAOPU-XiaoPu/web-design:root received a trust score of 13/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 5 findings: 2 critical, 2 high, 1 medium, and 0 low severity. Key findings include Arbitrary command execution, Dangerous call: subprocess.run(), Suspicious import: urllib.request.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on August 23, 2026 (commit 22a4f482). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | scripts/extract_design_tokens.py:53 | |
| CRITICAL | LLM-to-Shell Command Injection via Unsanitized URL Input The skill instructions in SKILL.md direct the host LLM to execute shell commands (such as crawl_website.py, extract_design_tokens.py, and curl) using unsanitized user-supplied URLs ([URL]). If a user provides a URL containing shell metacharacters (e.g., '; command' or '$(command)'), the host LLM may execute these commands directly in the shell, leading to arbitrary command execution on the host system. Avoid instructing the LLM to run raw shell commands with direct user inputs. Instead, use structured tool calls or ensure the script itself performs strict validation of the URL argument, and instruct the LLM to sanitize or reject inputs that do not match a strict URL regex. | LLM | SKILL.md:45 | |
| HIGH | Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'read_text_from_url'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | scripts/extract_design_tokens.py:53 | |
| HIGH | Arbitrary File Read via Path Traversal in Token Extractor The load_text function in scripts/extract_design_tokens.py parses the input source and, if the scheme is not http or https, directly reads the path from the local filesystem using Path(source).read_text(). This allows an attacker to supply a local file path (e.g., /etc/passwd or sensitive environment files) instead of a URL, leading to arbitrary file read and potential data exfiltration. Restrict the input to only allow http and https schemes, and validate that the resolved path does not access files outside of an allowed sandbox directory. Do not fall back to reading arbitrary local files if the scheme is missing or invalid. | LLM | scripts/extract_design_tokens.py:81 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | scripts/extract_design_tokens.py:24 |
Scan History
Embed Code
[](https://skillshield.io/report/e46f8e56c5618038)
Powered by SkillShield