Trust Assessment
githunt received a trust score of 94/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Unescaped user input in JSON payload construction, API endpoint configurable via environment variable.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unescaped user input in JSON payload construction The `scripts/githunt-search.sh` script constructs a JSON payload by directly interpolating user-provided arguments (`location`, `role`, `skills`) into a string. While `location` and `role` values are wrapped in double quotes, special characters like `"` or `\` within these inputs are not escaped. The `skills` array construction also does not escape individual skill names. This allows an attacker to inject arbitrary JSON fragments, leading to malformed requests or potentially altering the intended API call structure if the backend parser is permissive. This is a JSON injection vulnerability, not a shell command injection, but can cause API errors or unintended behavior. Use a robust JSON library or tool (e.g., `jq -nc --arg location "$location" --arg role "$role" ...`) to construct the JSON payload, ensuring all user-provided values are properly escaped. Alternatively, manually escape `"` and `\` characters in `$location`, `$role`, and individual `$skills` elements before interpolation. | LLM | scripts/githunt-search.sh:27 | |
| INFO | API endpoint configurable via environment variable The `scripts/githunt-search.sh` script allows the API endpoint to be overridden by the `GITHUNT_API_URL` environment variable. If an attacker can control this environment variable, they could redirect all API calls, including user-provided search queries (`location`, `role`, `skills`), to a malicious server. While the data sent is typically search parameters and not system-sensitive, users might input personally sensitive search terms. Ensure that the environment where this script runs is secured and that `GITHUNT_API_URL` cannot be easily tampered with by untrusted sources. Inform users that search queries might be sent to a different endpoint if this variable is set. For critical applications, consider whitelisting allowed API endpoints. | LLM | scripts/githunt-search.sh:6 |
Scan History
Embed Code
[](https://skillshield.io/report/f3e22c146332c8d7)
Powered by SkillShield