Trust Assessment
crypto-gold-monitor received a trust score of 69/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 0 medium, and 1 low severity. Key findings include Command Injection via --interval argument, Hardcoded 'demo' API token for GoldAPI.io.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 68/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection via --interval argument The script uses the `sleep` command with an unsanitized `$interval` variable, which is directly derived from user input via the `--interval` command-line argument. An attacker can inject arbitrary shell commands by providing a malicious string to `--interval`, leading to command execution on the host system. Sanitize the `$interval` variable to ensure it contains only numeric values before passing it to `sleep`. For example, use a regular expression to validate the input or cast it to an integer. A simple fix could be `sleep "${interval//[^0-9]/}"` or `if [[ "$interval" =~ ^[0-9]+$ ]]; then sleep "$interval"; else echo "Invalid interval"; fi`. | LLM | crypto-monitor.sh:307 | |
| LOW | Hardcoded 'demo' API token for GoldAPI.io The script uses a hardcoded 'demo' token for GoldAPI.io (`x-access-token: demo`). While this is not a direct credential harvesting risk for the user, it represents a supply chain risk. 'Demo' tokens often have severe rate limits, may be revoked without notice, or could lead to service instability for all users of the skill, impacting its reliability and long-term functionality. Consider using a more robust API key management strategy if GoldAPI.io is a critical data source. If the 'demo' token is intended for public use, ensure its limitations are clearly documented and that the skill can gracefully handle API failures or rate limits. Alternatively, explore other free APIs that do not require keys or have more generous public access policies. | LLM | crypto-monitor.sh:88 |
Scan History
Embed Code
[](https://skillshield.io/report/7f1cb2b49453daae)
Powered by SkillShield