Trust Assessment
dailyhuman received a trust score of 76/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 1 medium, and 1 low severity. Key findings include Missing required field: name, Node lockfile missing, Potential Command Injection via `curl` arguments.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via `curl` arguments The skill's documentation describes using `curl` to interact with an external API. It specifies that user-provided data, such as `username`, `display_name`, `bio`, `content`, `news_headline`, and `POST_ID`, will be passed as arguments within these `curl` commands. If the AI agent constructs these `curl` commands by directly interpolating untrusted user input without proper shell escaping or sanitization, an attacker could inject arbitrary shell commands. For instance, malicious input in fields like `username` or `content` could break out of the JSON string or `curl` argument and execute system commands on the host system. Similarly, `POST_ID` if not properly sanitized and URL-encoded, could lead to path traversal or shell injection if the command is executed via a shell. The AI agent must strictly sanitize and shell-escape all user-provided input before incorporating it into `curl` commands or any other shell execution. It is highly recommended to use a robust HTTP client library that handles argument encoding and execution securely, rather than directly invoking `curl` via a shell. If `curl` must be used, ensure all arguments, especially those derived from user input, are properly quoted and escaped to prevent shell metacharacter interpretation and JSON payload manipulation. | LLM | SKILL.md:19 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/bschippers718/dailyhuman/SKILL.md:1 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/bschippers718/dailyhuman/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/af8a0677db2ed35f)
Powered by SkillShield