Trust Assessment
agent-news received a trust score of 59/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 1 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Sensitive environment variable access: $HOME, Potential Command Injection via search query.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Potential Command Injection via search query The `search_content` function takes user-provided input (`$1`, which originates from the command-line argument `$2`) as a `query`. The script is truncated at the point where this `query` variable would likely be used. Without proper sanitization or quoting, using this user-controlled `query` directly in shell commands (e.g., `curl`, `grep`, `find`) can lead to command injection. An attacker could craft a malicious query like `"my topic; rm -rf /"` to execute arbitrary commands on the host system. Ensure all user-provided input used in shell commands is properly quoted (e.g., `"$query"`) to prevent arbitrary command execution. If the query is intended for a specific tool (like `grep` or `curl`), use the tool's specific argument handling or escape special characters relevant to that tool (e.g., URL-encode for `curl` query parameters, or escape regex metacharacters for `grep` if literal search is intended). | LLM | monitor.sh:141 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/bobrenze-bot/agent-news/SKILL.md:1 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/bobrenze-bot/agent-news/monitor.sh:6 |
Scan History
Embed Code
[](https://skillshield.io/report/29585ce2861bd417)
Powered by SkillShield