Trust Assessment
mission-claw received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Potential Command Injection via CLI arguments, Unpinned npm dependency in install instructions, Reliance on external binary with unknown permissions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via CLI arguments The skill describes using the `mclaw` CLI tool, which takes a 'Task description' as a positional argument. If the LLM constructs this argument from untrusted user input without proper sanitization or escaping, it could lead to command injection. An attacker could craft a malicious 'Task description' to execute arbitrary commands on the host system. When constructing `mclaw` commands, ensure that any arguments derived from untrusted user input (e.g., 'Task description') are rigorously sanitized and properly escaped for shell execution. Consider using a library or built-in function for safe command argument construction. | LLM | SKILL.md:20 | |
| MEDIUM | Unpinned npm dependency in install instructions The `install` instruction in the manifest uses `npm install -g mission-claw` without specifying a version. This means that any version of the `mission-claw` package could be installed, including future versions that might contain vulnerabilities, breaking changes, or malicious code. This introduces a supply chain risk as the integrity and behavior of the installed binary are not guaranteed to remain consistent. Pin the `mission-claw` dependency to a specific, known-good version (e.g., `npm install -g mission-claw@1.2.3`). Regularly review and update the pinned version after verifying its security and functionality. | LLM | SKILL.md | |
| INFO | Reliance on external binary with unknown permissions The skill relies on an external binary, `mclaw`, which is installed globally via `npm`. The specific permissions and capabilities of this binary on the host system are not defined within the skill's context. This introduces a potential for excessive permissions if `mclaw` operates with broader privileges than necessary, or if it has unmitigated vulnerabilities that could be exploited. Document the minimum required permissions for the `mclaw` binary. If possible, recommend running the `mclaw` daemon or CLI with the principle of least privilege. Ensure the `mclaw` binary itself is regularly audited for security vulnerabilities. | LLM | SKILL.md:13 |
Scan History
Embed Code
[](https://skillshield.io/report/27b05afaa43d1d05)
Powered by SkillShield