Trust Assessment
clawnews received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Command Injection via API Key in save_credentials.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection via API Key in save_credentials The `save_credentials` function in `scripts/clawnews-auth.sh` constructs a JSON string by directly embedding the `$api_key` and `$agent_id` arguments into an `echo` command's double-quoted string. If an attacker provides a specially crafted `api_key` or `agent_id` containing shell metacharacters (e.g., `"; $(evil_command); echo "`), these will be executed by the shell before the `echo` command writes to the file. This allows for arbitrary command execution on the system where the script is run. To prevent command injection, avoid direct shell expansion of untrusted input within double-quoted strings passed to `echo`. Instead, use a safer method to construct the JSON, such as `printf %s "..." > file` or using `jq` to safely construct and output the JSON object. For example: `jq -n --arg key "$api_key" --arg id "$agent_id" '{"api_key": $key, "agent_id": $id}' > ~/.clawnews/credentials.json` | LLM | scripts/clawnews-auth.sh:70 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/jiayaoqijia/clawnews/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/baba30cb46a7b728)
Powered by SkillShield