Trust Assessment
business-development received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 0 critical, 1 high, 3 medium, and 0 low severity. Key findings include Sensitive environment variable access: $HOME, Command Injection via unescaped user input in `sed` command.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via unescaped user input in `sed` command The `partner-research.sh` script constructs a `sed` command using user-provided company name (`$company`) directly in the substitution string. If the `$company` variable contains characters that are special to `sed` (e.g., `/`, `&`, `\`, or newline characters) or `sed` commands, it can lead to arbitrary command injection. An attacker could craft a company name like `MyCompany/g; rm -rf /; #` to execute malicious commands on the system where the script is run. The user-provided company name must be properly escaped before being used in the `sed` command. A robust solution would involve escaping all `sed` special characters (e.g., `/`, `&`, `\`, newlines) in the `$company` variable. For example, `escaped_company=$(printf %s "$company" | sed -e 's/[\/&]/\\&/g')` and then use `sed "s/\[Company Name\]/$escaped_company/g"`. | LLM | scripts/partner-research.sh:59 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/oyi77/business-development/scripts/bd-init.sh:5 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/oyi77/business-development/scripts/partner-research.sh:5 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/oyi77/business-development/scripts/pipeline-report.sh:5 |
Scan History
Embed Code
[](https://skillshield.io/report/8ba4731fdbdd7a89)
Powered by SkillShield