Trust Assessment
markdown-linter received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Potential Command Injection via Shell Instructions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via Shell Instructions The skill explicitly provides shell commands (`npx`, `grep`, `sed`, `while read`) as instructions for the LLM to execute. If the arguments to these commands (e.g., filenames, paths, or patterns) are derived from untrusted user input without proper sanitization, a malicious user could inject arbitrary shell commands. This could lead to remote code execution, data exfiltration, or system compromise. Examples include `npx markdownlint` (lines 20-29), `grep ... | sed ... | while read ...` (lines 50-56), and `grep ... | sed ...` (lines 60-63). To mitigate command injection risks, avoid instructing the LLM to directly execute shell commands. Instead, implement these functionalities as internal tool calls or API interactions within a sandboxed environment. If shell commands are unavoidable, ensure all user-provided inputs used as arguments are rigorously sanitized and validated to prevent injection of malicious commands or paths. Use libraries designed for safe command construction and execute commands with the principle of least privilege. | LLM | SKILL.md:20 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/sa9saq/markdown-linter/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/a5384549d82efe55)
Powered by SkillShield