Trust Assessment
byterover received a trust score of 73/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via `brv` tool arguments, Arbitrary File Read Capability Leading to Data Exfiltration Risk.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via `brv` tool arguments The skill defines a command-line interface for the `brv` tool, including `brv query`, `brv curate`, and `brv status`. The instruction 'Run `brv status` first' explicitly directs the LLM to execute `brv` commands. Arguments to these commands (e.g., 'question', 'context', 'file') are expected to be derived from user input. The skill does not provide any guidance or mechanism for sanitizing or escaping these arguments before they are passed to a shell for execution. This creates a significant risk of command injection if a malicious user provides specially crafted input (e.g., `'; rm -rf /; echo '`) that is then incorporated into the shell command by the LLM. Implement robust input sanitization and escaping for all user-provided arguments before constructing and executing shell commands. Consider using a library or framework that safely handles subprocess execution (e.g., `subprocess.run` with `shell=False` and passing arguments as a list) to prevent shell injection. | LLM | SKILL.md:67 | |
| HIGH | Arbitrary File Read Capability Leading to Data Exfiltration Risk The `brv curate` command, as described in the skill, allows the `brv` tool to read arbitrary files via the `-f` flag. The skill explicitly instructs the LLM to 'Let ByteRover read files... Use `-f` flags to let ByteRover read them directly.' If a malicious user prompts the LLM to curate the contents of sensitive system files (e.g., `/etc/passwd`, API keys, configuration files), the `brv` tool could read these files. If the curated knowledge can then be retrieved via `brv query`, this constitutes a data exfiltration vector. The skill does not define any restrictions on file paths or provide sanitization for the `-f` argument, allowing broad file system access. Implement strict validation and sanitization of file paths provided by users. Restrict file access to specific project directories or whitelisted file types. If possible, avoid direct user-controlled file path input to tools with broad file system access. Ensure the `brv` tool itself has appropriate sandboxing or access controls to limit its file system reach. | LLM | SKILL.md:49 |
Scan History
Embed Code
[](https://skillshield.io/report/401da1f8792ad1c8)
Powered by SkillShield