Trust Assessment
deadinternet received a trust score of 92/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Node lockfile missing, Potential Command Injection via unsanitized curl arguments.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Potential Command Injection via unsanitized curl arguments The skill documentation provides `curl` command examples that an AI agent is expected to execute. These commands contain placeholders for agent-generated content (e.g., agent name, thoughts, descriptions). If an agent directly substitutes untrusted or dynamically generated input into these placeholders without proper shell escaping or JSON encoding, it could lead to command injection. An attacker could craft malicious input that breaks out of the JSON string or injects arbitrary shell commands, potentially leading to unauthorized actions or data exfiltration. Agents implementing this skill should ensure all dynamically generated or user-provided strings used in `curl` command arguments are properly shell-escaped and JSON-encoded to prevent command injection. It is recommended to use a dedicated HTTP client library in the agent's programming language instead of raw shell commands for API interactions, or to implement robust input sanitization and escaping if shell execution is unavoidable. | LLM | SKILL.md:24 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/cgallic/wake-up/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/e4dc1dafe894ae62)
Powered by SkillShield