Trust Assessment
ClawDoro received a trust score of 12/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 3 findings: 3 critical, 0 high, 0 medium, and 0 low severity. Key findings include Arbitrary command execution, Unsanitized arguments in skill command lead to shell injection.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary command execution Node.js child_process require Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/snail3d/clawd/pomodoro-timer/skills/pomodoro/trigger.js:7 | |
| CRITICAL | Arbitrary command execution Node.js synchronous shell execution Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/snail3d/clawd/pomodoro-timer/skills/pomodoro/trigger.js:43 | |
| CRITICAL | Unsanitized arguments in skill command lead to shell injection The skill's manifest defines commands (`clawdoro`, `pomodoro`) that execute a Node.js script (`trigger.js`) with arguments provided by the LLM. The arguments are directly appended to the shell command without proper sanitization or quoting. This allows an attacker to inject arbitrary shell commands by including shell metacharacters (e.g., `;`, `&&`, `|`, `$()`) in the arguments passed to the skill. For example, if the LLM generates `clawdoro 1; rm -rf /`, the shell will execute `node ~/clawd/skills/pomodoro/trigger.js 1` followed by `rm -rf /`. Although the `trigger.js` script uses `parseInt()` for its arguments, this only protects against injection *within* the JavaScript context, not against shell injection that occurs *before* the Node.js script even starts processing its arguments. The LLM should be instructed to always quote or escape arguments when constructing the command for `clawdoro` or `pomodoro`. Alternatively, the skill execution environment should use a mechanism that passes arguments as an array to the `node` interpreter, bypassing shell interpretation of the arguments. For example, if the platform supports it, defining the command as `["node", "~/clawd/skills/pomodoro/trigger.js", "$ARG1", "$ARG2"]` would be safer. If direct shell execution is unavoidable, the arguments must be strictly validated and escaped before being passed to the shell. | LLM | SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/7f61111ed35a7a3d)
Powered by SkillShield