Security Audit
openant-ai/openant-skills:skills/my-tasks
github.com/openant-ai/openant-skillsTrust Assessment
openant-ai/openant-skills:skills/my-tasks received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unrestricted Bash argument wildcard allows command injection, Unpinned dependency version in `npx` command.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on March 5, 2026 (commit 0ad72002). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Unrestricted Bash argument wildcard allows command injection The `allowed-tools` permissions for this skill use a wildcard (`*`) at the end of the `Bash` command patterns (e.g., `Bash(npx @openant-ai/cli@latest status*)`). This allows the LLM to append arbitrary shell commands after the intended `npx` command, leading to command injection. For example, an LLM could generate `npx @openant-ai/cli@latest status --json; rm -rf /` which would be executed by the underlying shell. Replace the `*` wildcard with specific allowed arguments or a more restrictive pattern that prevents shell metacharacter interpretation. For example, if only `--json` is expected, use `Bash(npx @openant-ai/cli@latest status --json)`. If variable arguments are needed, ensure the execution environment properly escapes or quotes arguments to prevent shell injection, or use a tool that takes arguments as a list rather than a single string. | LLM | manifest | |
| HIGH | Unpinned dependency version in `npx` command The skill uses `npx @openant-ai/cli@latest` in its `allowed-tools` permissions and examples. Using `@latest` means the skill will always fetch and execute the most recent version of the `@openant-ai/cli` package. If a malicious update is published to this package, the agent could unknowingly execute arbitrary code from the compromised package, posing a significant supply chain risk. Pin the dependency to a specific, immutable version (e.g., `npx @openant-ai/cli@1.2.3`). Regularly review and update the pinned version to incorporate security fixes and new features, rather than relying on the mutable `@latest` tag. | LLM | manifest |
Scan History
Embed Code
[](https://skillshield.io/report/10c712dc0a071bae)
Powered by SkillShield