Trust Assessment
mingli received a trust score of 73/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 0 critical, 1 high, 2 medium, and 1 low severity. Key findings include Suspicious import: urllib.request, Potential Command Injection in Cron Job Creation, Unpinned `kerykeion` Dependency.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection in Cron Job Creation The skill's 'Cron Delivery' mechanism involves creating cron jobs using a JSON template with placeholders like `{username}`, `{hour}`, `{timezone}`, and `{telegram_chat_id}`. If these placeholders are directly substituted from untrusted user input without proper sanitization or escaping, a malicious user could inject arbitrary shell commands into the cron job definition. For example, providing a timezone like `Europe/London; rm -rf /` could lead to arbitrary command execution on the host system when the cron job is created. Implement robust input validation and sanitization for all user-provided values used in cron job creation, especially for fields like `timezone` and `username`. Ensure that any characters that could break out of the intended string context (e.g., semicolons, backticks, dollar signs, quotes) are properly escaped or rejected. Consider using a dedicated cron job management library that handles escaping automatically. | LLM | SKILL.md:83 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/hiehoo/mingli/scripts/fetch-planetary-positions.py:14 | |
| MEDIUM | Unpinned `kerykeion` Dependency The `SKILL.md` specifies `kerykeion` as a dependency to be installed via `pip` (`pip install kerykeion`) but does not pin it to a specific version. This practice can lead to supply chain vulnerabilities, as a future malicious update to the `kerykeion` package (or a typosquatting package with a higher version number) could be automatically installed, compromising the skill. Pin the `kerykeion` dependency to a specific, known-good version (e.g., `pip install kerykeion==X.Y.Z`). Use a `requirements.txt` file with exact versions and hash checking if possible. Regularly review and update dependencies. | LLM | SKILL.md:109 | |
| LOW | Potential Cross-User Data Redirection via Telegram Chat ID The skill allows users to provide a `Telegram chat ID` during setup for daily horoscope delivery. The cron job payload then sends horoscope data to this ID. If the skill's backend does not strictly validate that the provided `telegram_chat_id` belongs to the current authenticated user, or if there's a way for an attacker to associate another user's profile with their own `telegram_chat_id`, it could lead to the exfiltration of other users' personal horoscope data to an attacker-controlled Telegram chat. This is a design-level concern regarding user data isolation. Ensure strict validation and authorization checks for the `telegram_chat_id`. The system should verify that the provided `telegram_chat_id` is associated only with the requesting user and prevent any cross-user assignment or manipulation. Implement robust user session management and data isolation. | LLM | SKILL.md:92 |
Scan History
Embed Code
[](https://skillshield.io/report/505e673f636d335f)
Powered by SkillShield