Trust Assessment
agentmail-cli received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Unpinned Third-Party Dependency, Potential Command Injection via CLI Arguments.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via CLI Arguments The skill's documentation provides examples of executing the `agentmail` CLI tool directly via shell commands, including command substitution (`$()`) and passing various arguments like `--subject`, `--text`, `--to`, `<inbox-id>`, and `<message-id>`. If an LLM constructs these commands by directly interpolating untrusted user input into these arguments without proper shell escaping, it could lead to command injection. An attacker could craft input containing shell metacharacters (e.g., `'; rm -rf /'`) to execute arbitrary commands on the host system. When constructing shell commands based on user input, the LLM must rigorously sanitize and shell-escape all user-provided strings before passing them as arguments to the `agentmail` binary. The skill documentation should explicitly warn about this risk and recommend best practices for input sanitization. | LLM | SKILL.md:70 | |
| MEDIUM | Unpinned Third-Party Dependency The skill's manifest specifies a third-party npm package '@stepandel/agentmail-cli' without a pinned version. This introduces a supply chain risk, as future installations could pull a different, potentially incompatible or malicious, version if the package maintainer's account is compromised or if breaking changes are introduced. It also makes builds non-deterministic. Pin the npm dependency to a specific version (e.g., '@stepandel/agentmail-cli@1.2.3') in the manifest to ensure deterministic installations and mitigate risks from unexpected updates. | LLM | Manifest |
Scan History
Embed Code
[](https://skillshield.io/report/377ca3d15e05aab2)
Powered by SkillShield