Trust Assessment
browser-bookmarks received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Unsanitized URL in `curl` command leads to Command Injection.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsanitized URL in `curl` command leads to Command Injection The 'Check dead links' instruction provides a bash snippet that uses `curl` with a directly interpolated `$url` variable. If the `urls.txt` file, which is derived from user-provided bookmark data, contains URLs with shell metacharacters (e.g., `http://example.com; rm -rf /`), these metacharacters will be interpreted by the shell, leading to arbitrary command execution. This presents a significant command injection vulnerability if an AI agent or user executes this instruction with untrusted input. Sanitize the `$url` variable before passing it to `curl` by properly escaping shell metacharacters, or use a programming language's HTTP client library that handles URL encoding and command execution safely. If sticking to shell, consider using `curl -K <(echo 'url="$url"')` or a similar method to pass the URL as data rather than direct shell interpolation, or ensure robust shell escaping like `printf %q "$url"` if the shell supports it and the context allows. | LLM | SKILL.md:30 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/sa9saq/browser-bookmarks/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/1babad9b0e9a61aa)
Powered by SkillShield