Trust Assessment
manus received a trust score of 73/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include JSON Injection via 'profile' parameter in 'create' action, Path Traversal via 'output_dir' parameter in 'download' action.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | JSON Injection via 'profile' parameter in 'create' action The 'profile' parameter in the 'create' action is directly inserted into the JSON payload without proper sanitization. An attacker can inject arbitrary JSON fields by providing a specially crafted string for the profile, potentially altering the task creation request in unintended ways. Sanitize the 'profile' variable by passing it through `jq -Rs .` before embedding it in the JSON string, similar to how the 'prompt' variable is handled. Alternatively, validate the 'profile' against a strict whitelist of allowed values. | LLM | scripts/manus.sh:19 | |
| HIGH | Path Traversal via 'output_dir' parameter in 'download' action The 'output_dir' parameter in the 'download' action is used directly in `mkdir -p` and `curl -o` commands without sanitization. An attacker can specify a path like `../../etc` to write downloaded files to arbitrary locations on the filesystem, potentially overwriting critical system files or exfiltrating data if combined with other vulnerabilities. Sanitize the 'output_dir' variable to prevent path traversal. Ensure it is a simple directory name or a path strictly relative to the current working directory. Consider using `realpath -m` or a similar mechanism to resolve and validate the path, or restrict allowed characters and patterns (e.g., disallow '..' and absolute paths). | LLM | scripts/manus.sh:70 |
Scan History
Embed Code
[](https://skillshield.io/report/cf2985202ec30a5e)
Powered by SkillShield