Security Audit

hosted-agents

github.com/muratcankoylan/Agent-Skills-for-Context-Engineering

AI SkillCommit c578e85e40fe

TRUSTED

Scanned 30 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

hosted-agents received a trust score of 80/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Command Injection in ImageBuilder.build_image, Credential Exposure in Git Clone URL.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on August 1, 2026 (commit c578e85e). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

100%

Dependency Graph

100%

LLM Behavioral Safety

78%

Behavioral Risk Signals

Network Access

2 findings

Shell Execution

2 findings

Dynamic Code

1 finding

Excessive Permissions

1 finding

Security Findings2

Severity	Finding	Layer	Location
HIGH	Command Injection in ImageBuilder.build_image The `repo_url` parameter is interpolated directly into a shell command string without sanitization or escaping. If an attacker can control or manipulate the repository URL, they can inject arbitrary shell commands (e.g., using semicolons or backticks) that will execute in the build environment. Avoid executing shell commands via string interpolation. Use a list of arguments with `subprocess.run(..., shell=False)` or strictly validate and sanitize the `repo_url` using a regular expression to ensure it only contains safe characters (e.g., `^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$`).	LLM	scripts/sandbox_manager.py:164
MEDIUM	Credential Exposure in Git Clone URL The GitHub access token is embedded directly in the git clone URL. This exposes the token in process listings (e.g., via `ps`) during execution and saves the plaintext token in the repository's local git configuration (`/workspace/.git/config`), where it could be read by subsequent agent steps or unauthorized processes. Pass the token securely using Git's credential helper, environment variables, or via an HTTP header configuration (e.g., `git -c http.extraHeader="Authorization: Basic <token>" clone ...`) instead of embedding it in the URL.	LLM	scripts/sandbox_manager.py:164

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/deb1ccdb0c6c728e.svg)](https://skillshield.io/report/deb1ccdb0c6c728e)