Trust Assessment
clawchain-contributor received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Sensitive environment variable access: $USER, Sensitive environment variable access: $GITHUB_USER, Shell command injection via unsanitized user input.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Shell command injection via unsanitized user input The `scripts/check_contribution_score.sh` script uses the `$GITHUB_USER` variable, which can be derived from user input (`$1`), directly within shell commands (`grep`). If `$GITHUB_USER` contains shell metacharacters such as command substitutions (`$(...)` or backticks), these will be executed by the shell before the `grep` command is invoked, leading to arbitrary command execution. For example, providing `test$(id)` as input would execute the `id` command. Sanitize user input by escaping shell metacharacters before using it in shell commands. For `grep`, consider using `grep -F` for fixed string matching if the pattern is not intended to be a regular expression, and ensure the variable is properly quoted to prevent unintended shell expansion. A more robust solution would be to process the data in a language that offers safer string manipulation without shell interpolation, or to strictly validate the input to ensure it only contains allowed characters (e.g., alphanumeric, hyphens). | LLM | scripts/check_contribution_score.sh:15 | |
| MEDIUM | Sensitive environment variable access: $USER Access to sensitive environment variable '$USER' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/bowen31337/clawchain-contributor/scripts/check_contribution_score.sh:7 | |
| MEDIUM | Sensitive environment variable access: $GITHUB_USER Access to sensitive environment variable '$GITHUB_USER' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/bowen31337/clawchain-contributor/scripts/check_contribution_score.sh:10 |
Scan History
Embed Code
[](https://skillshield.io/report/2c0b48ce10375a7e)
Powered by SkillShield