Trust Assessment
hytale received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Sensitive environment variable access: $HOME, Execution of Unverified User-Provided Binary.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Execution of Unverified User-Provided Binary The `update` command in `hytale.sh` expects the user to manually download and place `hytale-downloader-linux-amd64` in `~/hytale_server/`. The script then applies `chmod +x` to this file and executes it without any integrity checks (e.g., checksum verification). This allows a malicious user to replace the legitimate downloader with arbitrary code, leading to command injection and potential compromise of the agent's environment. The skill effectively executes untrusted code provided by the user. Implement integrity checks for the `hytale-downloader-linux-amd64` binary before execution. This could involve downloading the binary directly within the script from a trusted source and verifying its checksum against a known good value, or requiring the user to provide a checksum that the script can verify. Avoid executing arbitrary user-provided binaries without strong validation. | LLM | hytale.sh:50 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/newcastlegeek/hytale/SKILL.md:1 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/newcastlegeek/hytale/hytale.sh:3 |
Scan History
Embed Code
[](https://skillshield.io/report/364b438441da7d42)
Powered by SkillShield