Trust Assessment
moltbook-signed-posts received a trust score of 69/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 0 critical, 1 high, 2 medium, and 1 low severity. Key findings include Sensitive environment variable access: $HOME, Node lockfile missing, Command Injection via Signature Argument in Verification Script.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via Signature Argument in Verification Script The `scripts/verify.sh` script is vulnerable to command injection. The `$SIGNATURE` argument, which is untrusted input, is directly passed to `echo` and then piped to `base64 -d`. If `$SIGNATURE` contains shell metacharacters (e.g., backticks, `$(...)`, or semicolons), these will be interpreted and executed by the shell before being piped to `base64`. This allows an attacker to execute arbitrary commands on the system where the verification script is run. To prevent shell interpretation of the `$SIGNATURE` variable, use `printf %s` instead of `echo`. The corrected line should be: `printf %s "$SIGNATURE" | base64 -d > "$TMPDIR/sig.bin"`. This ensures the content of `$SIGNATURE` is treated as a literal string. | LLM | scripts/verify.sh:28 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/igorls/moltbook-signed-posts/scripts/keygen.sh:7 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/igorls/moltbook-signed-posts/scripts/sign.sh:8 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/igorls/moltbook-signed-posts/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/7a0ae34da5418aeb)
Powered by SkillShield