Trust Assessment
heurist-mesh received a trust score of 50/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 1 critical, 1 high, 1 medium, and 0 low severity. Key findings include Sensitive environment variable access: $HOME, Sensitive path access: AI agent config, Potential Command Injection via `mcporter` arguments.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Potential Command Injection via `mcporter` arguments The skill instructs the LLM to construct and execute `mcporter` commands, passing user-provided input as arguments (e.g., `query`, `address`, `chain`). If the LLM directly interpolates untrusted user input into these shell commands without proper sanitization and shell-escaping, an attacker could inject arbitrary shell commands. For example, providing input like `'; rm -rf /; echo '` for a parameter could lead to remote code execution on the host system. Instruct the LLM to always sanitize and shell-escape any user-provided input before incorporating it into `mcporter` commands. This can be achieved by using a robust shell-escaping function (e.g., `shlex.quote` in Python) to ensure that user input is treated as a single, safe argument and cannot break out of its intended context to execute arbitrary commands. | LLM | SKILL.md:79 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.clawdbot/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | skills/wjw12/heurist-mesh/SKILL.md:37 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/wjw12/heurist-mesh/SKILL.md:16 |
Scan History
Embed Code
[](https://skillshield.io/report/3fe5c2c13c5e4f5c)
Powered by SkillShield