Trust Assessment
notion-2026-01-15 received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Potential for Command Injection via Unsanitized Placeholders in Shell Commands.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential for Command Injection via Unsanitized Placeholders in Shell Commands The skill provides `bash` examples containing placeholders (e.g., `{page_id}`, `{data_source_id}`). If an AI agent or LLM directly substitutes untrusted user input into these placeholders without proper sanitization (e.g., URL encoding for path segments, JSON escaping for body content, or shell escaping for command arguments), it could lead to arbitrary command execution on the host system. This is a common vulnerability pattern when an AI agent constructs and executes shell commands based on user input and skill examples. The AI agent consuming this skill must implement robust input validation and sanitization mechanisms to properly escape or encode any user-provided data before interpolating it into shell commands. The skill documentation could also include explicit warnings about input sanitization for developers. | LLM | SKILL.md:49 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/dongkukim/notion-2026-01-15/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/9bbd37188b9d6ded)
Powered by SkillShield