Trust Assessment
gopls-lsp received a trust score of 75/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Sensitive environment variable access: $HOME, Unpinned dependency in installation instructions, Potential command injection in documented shell commands.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential command injection in documented shell commands The skill documentation includes several shell commands with placeholders (e.g., `go mod init <module>`, `go get <package>`, `gofmt -w file.go`, `go run main.go`). If an AI agent uses these commands and allows user input to fill these placeholders without proper sanitization or validation, it could lead to command injection. An attacker could craft malicious input (e.g., `my_module; rm -rf /`) to execute arbitrary commands on the host system where the agent is running. When constructing shell commands based on user input, ensure all user-provided arguments are strictly validated and sanitized. Prefer passing arguments as a list to `subprocess.run` (or equivalent in other languages) with `shell=False` to avoid shell interpretation, or implement robust input validation and escaping if shell execution is unavoidable. | LLM | SKILL.md:75 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/bowen31337/gopls-lsp/SKILL.md:22 | |
| MEDIUM | Unpinned dependency in installation instructions The installation instruction `go install golang.org/x/tools/gopls@latest` uses the `@latest` tag, which means the specific version of `gopls` is not pinned. This can lead to non-deterministic installations and introduces a supply chain risk, as a malicious update to the `gopls` tool could be automatically installed without explicit review, potentially introducing vulnerabilities or backdoors. Pin the dependency to a specific version (e.g., `go install golang.org/x/tools/gopls@v0.14.0`) to ensure deterministic installations and mitigate risks from unexpected or malicious updates. | LLM | SKILL.md:18 |
Scan History
Embed Code
[](https://skillshield.io/report/46a166e03a3cde8d)
Powered by SkillShield