Trust Assessment
earnings-calendar received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Suspicious import: requests, Potential Shell Command Injection via API Key.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Shell Command Injection via API Key The skill describes executing a Python script (`scripts/fetch_earnings_fmp.py`) and passing the FMP API key as a command-line argument using shell interpolation: `"${API_KEY}"`. If the `API_KEY` is derived directly from untrusted user input without robust sanitization, a malicious user could inject shell metacharacters (e.g., a single quote `'` to break out of the double quotes, followed by a new command like `; rm -rf /`) into the `API_KEY` value. This could lead to arbitrary command execution on the host system. Implement strict validation and sanitization of user-provided API keys before they are used in shell commands. A safer approach is to pass sensitive data via environment variables or standard input to the Python script, or to ensure the API key is passed as a distinct argument to the Python interpreter directly (e.g., `subprocess.run(['python', 'script.py', '--api-key', api_key_value])` where `api_key_value` is a list element, preventing shell interpretation). If shell execution is necessary, ensure the `API_KEY` is properly escaped for the target shell (e.g., using `shlex.quote` in Python). | LLM | SKILL.md:199 | |
| MEDIUM | Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/veeramanikandanr48/earnings-calendar/scripts/fetch_earnings_fmp.py:23 |
Scan History
Embed Code
[](https://skillshield.io/report/2f1712ac421968d9)
Powered by SkillShield