Trust Assessment
config-diff received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Potential Command Injection via unsanitized file paths in shell commands.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via unsanitized file paths in shell commands The skill's instructions describe executing shell commands (`jq`, `diff`, `yq`, `sort`) on user-provided configuration files. If the filenames or file content are directly incorporated into these shell commands without proper sanitization, a malicious user could inject arbitrary shell commands. For example, a filename like `'; rm -rf /tmp/evil'` could lead to command execution, allowing an attacker to execute arbitrary code on the host system. Implement robust input sanitization and validation for all user-provided file paths and content before constructing and executing shell commands. Consider using a safe subprocess execution library that avoids shell interpretation (e.g., `subprocess.run` with `shell=False` and passing arguments as a list) or explicitly escaping all user-controlled arguments to prevent shell metacharacter injection. | LLM | SKILL.md:12 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/sa9saq/config-diff/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/bfb7bcbf13041e99)
Powered by SkillShield