Trust Assessment
appdeploy received a trust score of 57/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Dangerous tool allowed: Bash, Excessive permissions: Bash tool allowed.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Excessive permissions: Bash tool allowed The skill's manifest declares 'Bash' as an allowed tool. This grants the LLM the ability to execute arbitrary shell commands on the host system, which is a significant security risk. While the skill's documentation describes using 'curl' commands, the 'Bash' permission itself allows for much broader and potentially malicious command execution if the LLM is compromised or constructs commands unsafely with untrusted input. This capability can lead to command injection, data exfiltration, or system compromise. Restrict tool access to specific, purpose-built tools with minimal capabilities instead of a general shell executor like `Bash`. If `Bash` is absolutely necessary, implement strict input sanitization and command whitelisting for any user-controlled input passed to `Bash` commands, and ensure commands are executed with the least privilege possible. | LLM | SKILL.md | |
| HIGH | Dangerous tool allowed: Bash The skill allows the 'Bash' tool without constraints. This grants arbitrary command execution. Remove unconstrained shell/exec tools from allowed-tools, or add specific command constraints. | Static | skills/avimak/appdeploy/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/564e3158f41017fa)
Powered by SkillShield