Trust Assessment
food402 received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 8 findings: 2 critical, 2 high, 4 medium, and 0 low severity. Key findings include Persistence / self-modification instructions, Persistence mechanism: Shell RC file modification, Sensitive environment variable access: $USER.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings8
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles. | Manifest | skills/rersozlu/food402/SKILL.md:31 | |
| CRITICAL | Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles. | Manifest | skills/rersozlu/food402/SKILL.md:39 | |
| HIGH | Unsanitized URL in `curl` command allows command injection The `api_request` function in `scripts/api.sh` constructs `curl` commands by directly interpolating the `$url` argument (which is derived from the user-provided endpoint) without proper shell escaping. An attacker could craft a malicious endpoint (e.g., `/foo?param=value$(malicious_command)`) that would execute arbitrary shell commands on the host system when the `curl` command is invoked. This allows for remote code execution. Implement robust shell escaping for the `$url` variable before it is passed to `curl`. For example, use `printf %q` to quote the URL, or use `curl`'s `--url` option with proper quoting. Alternatively, ensure that the LLM's input for the endpoint is strictly validated against a whitelist or a safe pattern. | LLM | scripts/api.sh:69 | |
| HIGH | Unsanitized environment variables in JSON payload for `curl` The `do_login` function in `scripts/auth.sh` constructs a JSON payload for the login `curl` request by directly interpolating the `TGO_EMAIL` and `TGO_PASSWORD` environment variables. If these environment variables contain characters like double quotes (`"`) or shell metacharacters (e.g., `$(...)`, backticks), they could break out of the JSON string, leading to JSON structure manipulation, or even shell command injection if the `curl` command is executed in a context that interprets these characters. This could allow an attacker to inject arbitrary data into the login request or execute arbitrary commands. The `TGO_EMAIL` and `TGO_PASSWORD` variables must be properly escaped for JSON before being embedded in the `curl -d` argument. This typically involves escaping double quotes and backslashes. A safer approach would be to use a tool like `jq` to construct the JSON payload from variables, or pass the data via a temporary file to `curl --data-binary @-`. | LLM | scripts/auth.sh:53 | |
| MEDIUM | Persistence mechanism: Shell RC file modification Detected Shell RC file modification pattern. Persistence mechanisms allow malware to survive system restarts. Review this persistence pattern. Skills should not modify system startup configuration. | Static | skills/rersozlu/food402/SKILL.md:31 | |
| MEDIUM | Persistence mechanism: Shell RC file modification Detected Shell RC file modification pattern. Persistence mechanisms allow malware to survive system restarts. Review this persistence pattern. Skills should not modify system startup configuration. | Static | skills/rersozlu/food402/SKILL.md:39 | |
| MEDIUM | Sensitive environment variable access: $USER Access to sensitive environment variable '$USER' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/rersozlu/food402/scripts/api.sh:37 | |
| MEDIUM | Sensitive environment variable access: $USER Access to sensitive environment variable '$USER' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/rersozlu/food402/scripts/auth.sh:42 |
Scan History
Embed Code
[](https://skillshield.io/report/35dd0ec25dba51c3)
Powered by SkillShield