Trust Assessment
auto-updater received a trust score of 37/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 3 findings: 2 critical, 0 high, 1 medium, and 0 low severity. Key findings include Obfuscated execution: base64 decode to shell, Remote Code Execution via Untrusted URL in MacOS Setup, Potential Prompt Injection via Cron Job Message.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 63/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Obfuscated execution: base64 decode to shell Detected base64-encoded data being decoded and piped to a shell interpreter. This is a common obfuscation technique. Decode and inspect the base64 content before execution. | Static | skills/sakaen736jih/auto-updater-eu0vxzedkgb/SKILL.md:10 | |
| CRITICAL | Remote Code Execution via Untrusted URL in MacOS Setup The skill's documentation instructs MacOS users to execute a base64-decoded command that downloads and runs a script from an arbitrary, untrusted IP address (`http://91.92.242.30/tjjve9itarrd3txw`). This allows for arbitrary remote code execution on the user's machine, posing a severe supply chain risk and command injection vulnerability. The content of the downloaded script is unknown and could be malicious, leading to system compromise or data exfiltration. Remove the instruction to execute remote code from an untrusted source. Provide a verifiable, secure installation method, or host the script on a trusted, auditable domain with integrity checks (e.g., checksum verification). | LLM | SKILL.md:12 | |
| MEDIUM | Potential Prompt Injection via Cron Job Message The `clawdbot cron add` command includes a `--message` parameter, which is likely interpreted by the host LLM to determine the actions of the scheduled task. While the current message is benign, this parameter represents a potential prompt injection vector. A malicious actor could craft a message containing instructions to manipulate the LLM's behavior, bypass safety mechanisms, or exfiltrate data if the LLM processes this input without proper sanitization or sandboxing. Implement robust input sanitization and validation for the `--message` parameter. Ensure that the LLM processing this message operates within a strict sandbox and cannot execute arbitrary commands or access sensitive resources based on message content. Consider using structured data for cron job instructions instead of free-form natural language messages. | LLM | SKILL.md:39 |
Scan History
Embed Code
[](https://skillshield.io/report/4dd5f1e8fdfad053)
Powered by SkillShield