Trust Assessment
jami received a trust score of 87/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Sensitive environment variable access: $HOME, User-controlled log file path allows data exfiltration.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/snail3d/clawd/jami-skill/scripts/jami_contacts.sh:7 | |
| MEDIUM | User-controlled log file path allows data exfiltration The `jami_listener.sh` script allows the first argument to specify the `LOG_FILE` path. An attacker, through prompt injection to the LLM, could instruct the LLM to provide a path to a publicly accessible directory or a location readable by other services. This could lead to the exfiltration of Jami call activity logs, as the script writes call details to this user-specified file. While the content logged is specific to Jami activity, controlling the output location is a security risk. Restrict the `LOG_FILE` path to a predefined, secure directory (e.g., a subdirectory within the skill's own data directory or a temporary directory with restricted permissions) or sanitize the input to prevent directory traversal. Do not allow arbitrary file paths for logging. | LLM | scripts/jami_listener.sh:4 |
Scan History
Embed Code
[](https://skillshield.io/report/d8a8a128ecaac77d)
Powered by SkillShield