Trust Assessment
clearbit received a trust score of 90/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via unsanitized URL parameters in `curl` commands.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via unsanitized URL parameters in `curl` commands The skill's examples demonstrate `curl` commands that embed parameters like `email`, `domain`, and `ip` directly into the URL string. If an AI agent were to construct these commands by directly substituting untrusted user input into these parameters without proper shell escaping or URL encoding, an attacker could craft malicious input (e.g., `email="user@example.com\"%20%26%26%20echo%20pwned%20%23"`) that breaks out of the URL string and executes arbitrary shell commands on the host system. This pattern is present in all `curl` examples provided within the skill description. When constructing `curl` commands from user input, ensure all user-provided parameters are properly shell-escaped and/or URL-encoded before being embedded into the command string. For example, use a library function to safely quote arguments for shell execution or ensure parameters are passed as separate arguments if the tool supports it, rather than concatenating into a single string. The LLM should be instructed to sanitize all user-provided inputs before incorporating them into shell commands. | LLM | SKILL.md:9 |
Scan History
Embed Code
[](https://skillshield.io/report/b6cbafe30bf6e1a1)
Powered by SkillShield