Trust Assessment
asr received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Command Injection via Unsanitized User Input in Shell Script.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection via Unsanitized User Input in Shell Script The `asr.sh` script constructs `curl` commands and a JSON payload using user-controlled input variables (`$URL`, `$FILE`, `$LANGUAGE`, `$FORMAT`, `$WEBHOOK`) without proper sanitization or escaping. This allows for shell command substitution (e.g., `$(command)`) to be executed by the shell before the `curl` command is invoked. An attacker could craft a malicious input string for any of these parameters to execute arbitrary commands on the system running the skill, leading to data exfiltration, system compromise, or denial of service. Sanitize or escape all user-controlled input variables (`$URL`, `$FILE`, `$LANGUAGE`, `$FORMAT`, `$WEBHOOK`) before they are used in `curl` commands or within the heredoc. For example, implement strict input validation to ensure values conform to expected formats (e.g., URL, file path, language code) and do not contain shell metacharacters. For JSON construction, consider using a dedicated JSON parsing utility (e.g., `jq`) to safely build the payload, or manually escape special characters in the input strings. | LLM | scripts/asr.sh:53 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/ilyakam/asr/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/ab3482f1d77567d9)
Powered by SkillShield