Trust Assessment
memory-curator received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Sensitive environment variable access: $HOME, Unsanitized user input in file paths leads to path traversal and arbitrary file write.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsanitized user input in file paths leads to path traversal and arbitrary file write The `generate-digest.sh` script uses the first command-line argument (`$1`) directly to construct file paths for `$LOG_FILE` and `$DIGEST_FILE` without proper sanitization. An attacker can provide a malicious string containing path traversal sequences (e.g., `../../`) to read or write files outside the intended `$HOME/clawd/memory` directory. Specifically, the `cat > "$DIGEST_FILE"` command can be exploited to write arbitrary content to any file the script's user has write permissions to, potentially leading to system compromise or data corruption. Implement strict input validation for the `$1` argument to ensure it conforms to the expected `YYYY-MM-DD` format and does not contain path traversal characters (e.g., `/`, `..`). A regular expression check is recommended. For example: ```bash if [[ -n "$1" && ! "$1" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then echo "Error: Invalid date format. Please use YYYY-MM-DD." exit 1 fi DATE="${1:-$(date -u +%Y-%m-%d)}" ``` | LLM | scripts/generate-digest.sh:10 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/77darius77/memory-curator/scripts/generate-digest.sh:9 |
Scan History
Embed Code
[](https://skillshield.io/report/c79c21becb2c96d5)
Powered by SkillShield