Trust Assessment
memory-curator received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Sensitive environment variable access: $HOME, Command Injection via Unsanitized Script Argument.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via Unsanitized Script Argument The `generate-digest.sh` script uses the first command-line argument (`$1`) directly in a variable assignment without proper sanitization or validation. The expression `DATE="${1:-$(date -u +%Y-%m-%d)}"` evaluates the content of `$1` for shell expansions (like command substitution `$(...)` or backticks) before assigning it to the `DATE` variable. This allows an attacker to inject and execute arbitrary shell commands by providing a specially crafted string as the date argument. Validate the format of the input argument `$1` to ensure it strictly adheres to the expected `YYYY-MM-DD` date format before using it. If the format is invalid, the script should exit with an error. For example, add a check like `if ! [[ "$DATE_INPUT" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then echo "Error: Invalid date format."; exit 1; fi` after assigning the input to a temporary variable. | LLM | scripts/generate-digest.sh:9 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/themiloway/memory-curator/scripts/generate-digest.sh:9 |
Scan History
Embed Code
[](https://skillshield.io/report/ce8f4f3daa5dc040)
Powered by SkillShield