Trust Assessment
agent-credit received a trust score of 58/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 5 findings: 0 critical, 1 high, 4 medium, and 0 low severity. Key findings include Sensitive environment variable access: $HOME, Unsanitized user input in jq query leads to command injection.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsanitized user input in jq query leads to command injection The shell scripts construct `jq` commands using the `$SYMBOL` variable, which is taken directly from user input (`$1`). If `$SYMBOL` contains shell metacharacters (e.g., `"; rm -rf /; echo "`), it can break out of the `jq` string and execute arbitrary shell commands. This pattern is present in `aave-borrow.sh`, `aave-status.sh`, `aave-repay.sh`, and `aave-setup.sh`. Sanitize the `$SYMBOL` variable before using it in the `jq` command, or use a safer method to pass the variable to `jq` (e.g., `jq --arg symbol "$SYMBOL" -r '.assets[$symbol].address // empty' "$CONFIG"`). Alternatively, validate `$SYMBOL` against a whitelist of allowed characters or known asset symbols. | LLM | aave-borrow.sh:30 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/aaronjmars/agent-credit/aave-borrow.sh:7 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/aaronjmars/agent-credit/aave-repay.sh:11 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/aaronjmars/agent-credit/aave-setup.sh:8 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/aaronjmars/agent-credit/aave-status.sh:9 |
Scan History
Embed Code
[](https://skillshield.io/report/dc49599d6f9f4511)
Powered by SkillShield