Trust Assessment
ACP Rank received a trust score of 88/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via `curl` arguments.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via `curl` arguments The skill documentation explicitly states a dependency on `curl` and provides numerous examples of `curl` commands that incorporate user-controlled inputs (e.g., `agent_id`, `q`, `tags`, `date`, `page`, `limit`, `before`, `after`, `start`, `stop`) directly into URL paths and query parameters. If the LLM constructs these `curl` commands by directly concatenating user input without proper shell escaping or URL encoding, an attacker could inject arbitrary shell commands (e.g., `agent_id=foo.aid.pub%3B%20rm%20-rf%20%2F` or `q="; ls -la; #`) leading to command execution on the host system. This is a common vulnerability pattern when external binaries are invoked with unsanitized user input. Ensure all user-provided inputs used in `curl` commands are strictly validated, URL-encoded, and shell-escaped before being interpolated into the command string. Prefer using a robust HTTP client library that handles parameter encoding automatically over direct shell command execution with string concatenation. Implement a allowlist for acceptable input values where possible. | LLM | SKILL.md:68 |
Scan History
Embed Code
[](https://skillshield.io/report/ca64cfe30b46e9e2)
Powered by SkillShield