Trust Assessment
nocodb received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 2 critical, 0 high, 0 medium, and 0 low severity. Key findings include Unsafe variable interpolation in python3 -c leads to command injection.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Unsafe variable interpolation in python3 -c leads to command injection The `cmd_rows` function constructs a `python3 -c` command string by directly interpolating the `$SORT` and `$WHERE` variables. If these variables contain shell metacharacters (e.g., `;`, `|`, `&`, `$()`, `` ` ``), an attacker can inject arbitrary shell commands that will be executed by the `bash` interpreter before `python3` is invoked. This allows for arbitrary code execution on the host system. Pass the variables as arguments to the Python script instead of interpolating them directly into the command string. For example, change: `python3 -c "import urllib.parse; print(urllib.parse.quote('$SORT'))"` to: `python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1]))' "$SORT"` This ensures that `$SORT` is passed as a literal argument to the Python script, preventing shell injection. Apply the same fix for the `$WHERE` variable on line 175. | LLM | scripts/nocodb.sh:172 | |
| CRITICAL | Unsafe variable interpolation in python3 -c leads to command injection The `cmd_rows` function constructs a `python3 -c` command string by directly interpolating the `$SORT` and `$WHERE` variables. If these variables contain shell metacharacters (e.g., `;`, `|`, `&`, `$()`, `` ` ``), an attacker can inject arbitrary shell commands that will be executed by the `bash` interpreter before `python3` is invoked. This allows for arbitrary code execution on the host system. Pass the variables as arguments to the Python script instead of interpolating them directly into the command string. For example, change: `python3 -c "import urllib.parse; print(urllib.parse.quote('$WHERE'))"` to: `python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1]))' "$WHERE"` This ensures that `$WHERE` is passed as a literal argument to the Python script, preventing shell injection. Apply the same fix for the `$SORT` variable on line 172. | LLM | scripts/nocodb.sh:175 |
Scan History
Embed Code
[](https://skillshield.io/report/a8caac6944f109ff)
Powered by SkillShield