Trust Assessment
generect-api received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Command Injection Vulnerability in Shell Script.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection Vulnerability in Shell Script The `generect.sh` script directly inserts the user-provided second argument (`$body`) into a `curl -d` command without proper sanitization or quoting. This allows an attacker to inject arbitrary shell commands by crafting a malicious JSON body. For example, if `$body` is set to `'{"key":"value"}' -o /dev/null; rm -rf /`, the `rm -rf /` command would be executed on the system running the script. Ensure that user-provided input used in shell commands is properly sanitized and quoted. For JSON data passed to `curl -d`, it's best to use a method that explicitly treats the data as a literal string or file content, preventing shell interpretation. One common fix is to use `printf %s "$body" | curl -sS -X POST "$endpoint" -H "$AUTH" -H "Content-Type: application/json" -d @-` or to ensure the `$body` variable is strictly validated as JSON before being passed to `curl` and then quoted appropriately, e.g., `curl ... -d "$(printf %s "$body")"` or using a temporary file for the body. | LLM | scripts/generect.sh:26 |
Scan History
Embed Code
[](https://skillshield.io/report/cfaaae08753d3ad7)
Powered by SkillShield