Trust Assessment
droyd received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Sensitive environment variable access: $HOME, Unsanitized argument in droyd-positions.sh leads to command injection.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsanitized argument in droyd-positions.sh leads to command injection The `droyd-positions.sh` script directly interpolates the first command-line argument (`$1`) into the `leg_status` query parameter of a `curl` request without proper sanitization or quoting. An attacker could provide a malicious string containing shell metacharacters (e.g., `$(command)`) as the `leg_status` argument, leading to arbitrary command execution on the host system. This could be used to exfiltrate the DROYD API key or other sensitive information. To prevent command injection, ensure that all user-supplied inputs are properly sanitized or quoted before being used in shell commands or URLs. For `curl` GET requests, consider using `curl -G --data-urlencode "leg_status=$STATUS"` instead of direct string concatenation, or explicitly escape the `$STATUS` variable using `printf %q` if it's guaranteed to be a simple string. Alternatively, validate `$STATUS` against a whitelist of allowed values (e.g., "active", "all"). | LLM | scripts/droyd-positions.sh:13 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/dustinjamest/droyd/scripts/droyd.sh:8 |
Scan History
Embed Code
[](https://skillshield.io/report/e4a879086b1902a5)
Powered by SkillShield