Trust Assessment
intellectia-stock-forecast received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Command Injection via Shell Execution Examples.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via Shell Execution Examples The skill's documentation provides examples for interacting with the Intellectia API using `curl` and `python3` executed via `python3 - <<'PY'`. Both methods involve direct shell command execution. If the host LLM constructs these commands or Python scripts by directly interpolating user-provided input (such as `ticker` or `asset_type`) without robust sanitization or shell escaping, a malicious user could inject arbitrary shell commands or Python code. This could lead to remote code execution on the host system. The host LLM must implement strict input validation and sanitization for all user-provided parameters before constructing and executing shell commands or Python scripts. For `curl` commands, ensure all user-controlled arguments are properly shell-escaped. For Python scripts, user input should be passed as data (e.g., dictionary values for `requests.params` or `requests.json`) and never directly interpolated into the Python code structure itself. Consider using safer execution environments or APIs that abstract away direct shell command construction. | LLM | SKILL.md:49 |
Scan History
Embed Code
[](https://skillshield.io/report/1710da8b0e4778af)
Powered by SkillShield