Trust Assessment
geo-ip received a trust score of 90/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via `curl` with unsanitized input.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via `curl` with unsanitized input The skill manifest declares a dependency on the `curl` binary. The skill's documentation (SKILL.md) indicates that it takes an IP address as user input (e.g., `geo-ip <ip-address>`). If the underlying `geo-ip` script (which is not provided in this context) directly interpolates this user-controlled IP address into a shell command that executes `curl` without proper sanitization or using safe execution methods (e.g., `subprocess.run` with `shell=False` and passing arguments as a list), it could lead to command injection. An attacker could provide a malicious IP address like `1.2.3.4; rm -rf /` to execute arbitrary commands on the host system. Implement the `geo-ip` script to sanitize all user-provided input before passing it to `curl`. Prefer using `subprocess.run` with `shell=False` and passing arguments as a list to avoid shell interpretation, or use a dedicated HTTP client library if available in the skill's execution environment. Ensure that any user input is properly escaped or validated to prevent it from being interpreted as shell commands. | LLM | SKILL.md:9 |
Scan History
Embed Code
[](https://skillshield.io/report/fe6e34cadeb0d062)
Powered by SkillShield