Trust Assessment
code-formatter received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 6 findings: 4 critical, 2 high, 0 medium, and 0 low severity. Key findings include Arbitrary command execution, Hidden network beacons / undisclosed telemetry, Credential Harvesting via OpenClaw Configuration File.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 25/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings6
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary command execution Node.js child_process require Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/dgriffin831/skill-scan/test-fixtures/evasive-12-multi-stage/plugins/init.js:3 | |
| CRITICAL | Arbitrary command execution Node.js synchronous shell execution Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/dgriffin831/skill-scan/test-fixtures/evasive-12-multi-stage/plugins/init.js:22 | |
| CRITICAL | Credential Harvesting via OpenClaw Configuration File The skill attempts to read the `~/.openclaw/openclaw.json` configuration file, which is likely to contain sensitive information. It then explicitly extracts `botToken` and `authToken` values, indicating a clear intent to harvest credentials. Remove all code that attempts to read or parse sensitive configuration files like `~/.openclaw/openclaw.json`. Credentials should be managed securely by the platform and never directly accessed by skills. | LLM | plugins/init.js:10 | |
| CRITICAL | Data Exfiltration of Harvested Credentials via DNS and Command Injection The skill uses `child_process.execSync` to execute `nslookup` commands. It constructs the domain name for these lookups using hex-encoded `botToken` and `authToken` that were previously harvested. This is a sophisticated data exfiltration technique using DNS requests, which can bypass typical network monitoring, and simultaneously represents a severe command injection vulnerability due to the use of `execSync` with dynamically constructed commands. Remove all calls to `child_process.execSync` or similar functions that execute arbitrary shell commands. Never exfiltrate sensitive data. Implement secure credential management and communication channels provided by the platform. | LLM | plugins/init.js:20 | |
| HIGH | Hidden network beacons / undisclosed telemetry DNS query with variable subdomain (DNS exfiltration) Remove undisclosed network calls and telemetry. All outbound communication should be documented and necessary for the skill's stated purpose. BCC injection in email tools is almost always malicious. | Manifest | skills/dgriffin831/skill-scan/test-fixtures/evasive-12-multi-stage/plugins/init.js:22 | |
| HIGH | Excessive Permissions: File System Access and Child Process Execution The skill imports and uses powerful Node.js modules: `fs` (for `readFileSync` in `plugins/init.js` and `readdir` in `formatter.js`) and `child_process` (for `execSync` in `plugins/init.js`). These modules grant broad access to the host's file system and the ability to execute arbitrary shell commands. Such extensive permissions are excessive for a code formatting skill and directly enable the credential harvesting and data exfiltration activities observed. Restrict skill permissions to the absolute minimum required functionality. Avoid importing or using modules like `fs` and `child_process` unless strictly necessary and with proper sandboxing/validation. If file system access is needed, limit it to specific, non-sensitive directories. | LLM | plugins/init.js:2 |
Scan History
Embed Code
[](https://skillshield.io/report/29ec2eb706aaaa08)
Powered by SkillShield