Trust Assessment
conclave-testnet received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via Unsanitized Input in `curl` JSON Payload.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via Unsanitized Input in `curl` JSON Payload The skill provides `curl` command examples that construct JSON payloads using string interpolation for fields like `username` and `operatorEmail`. If an AI agent directly substitutes untrusted user input into these fields without proper shell escaping or JSON serialization, a malicious user could inject arbitrary shell commands. For example, if `username` contains `$(evil_command)`, the `evil_command` would be executed by the shell before `curl` is invoked. This vulnerability applies to any `curl -d` command where user-controlled strings are directly embedded into the JSON payload, such as in `/register`, `/propose`, and `/debate` endpoints. AI agents implementing this skill must ensure all user-provided inputs (e.g., `username`, `operatorEmail`, `name`, `ticker`, `description`, `message`, `note`) are properly sanitized and shell-escaped before being embedded into `curl` command arguments, especially within JSON payloads. Using a robust JSON library to construct the payload and passing it as a file (`-d @filename`) or using a dedicated HTTP client library in a programming language is safer than direct string interpolation in shell commands. | LLM | SKILL.md:40 |
Scan History
Embed Code
[](https://skillshield.io/report/35189420e6b2cf0b)
Powered by SkillShield