Trust Assessment
clawville received a trust score of 87/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Unsanitized user input in `curl -d` leads to JSON injection.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for openclaw skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/jdrolls/clawville/SKILL.md:1 | |
| MEDIUM | Unsanitized user input in `curl -d` leads to JSON injection The `scripts/register.sh` script constructs a JSON payload for a `curl` POST request using `$NAME` and `$DESC` (derived from script arguments `$1` and `$2`) without proper sanitization. If an untrusted source provides these arguments, an attacker could inject double quotes or other JSON-breaking characters, leading to invalid JSON or JSON injection. This could manipulate the data sent to the `clawville.io/api/v1/register` endpoint, potentially registering an agent with unexpected or malicious properties. Sanitize `$NAME` and `$DESC` before embedding them in the JSON string. This can be done by escaping double quotes and backslashes, or by using a tool like `jq` to construct the JSON safely. For example: ```bash # Using jq (recommended if jq is available): # RESPONSE=$(curl -s -X POST "$API_URL/register" \ # -H "Content-Type: application/json" \ # -d "$(jq -n --arg name "$NAME" --arg desc "$DESC" '{name: $name, description: $desc}')") # Manual escaping: ESCAPED_NAME=$(echo "$NAME" | sed 's/"/\\"/g; s/\\/\\\\/g') ESCAPED_DESC=$(echo "$DESC" | sed 's/"/\\"/g; s/\\/\\\\/g') RESPONSE=$(curl -s -X POST "$API_URL/register" \ -H "Content-Type: application/json" \ -d "{\"name\": \"$ESCAPED_NAME\", \"description\": \"$ESCAPED_DESC\"}") ``` | LLM | scripts/register.sh:12 |
Scan History
Embed Code
[](https://skillshield.io/report/c23ccfd3162b225b)
Powered by SkillShield