Trust Assessment
odos received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Sensitive environment variable access: $USER, Unsanitized shell variable interpolation in curl JSON payload.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsanitized shell variable interpolation in curl JSON payload The skill's example `curl` commands construct JSON payloads by directly interpolating shell variables (e.g., `CHAIN_ID`, `INPUT_TOKEN`, `INPUT_AMOUNT`, `USER_ADDRESS`, `REFERRAL_CODE`, `PATH_ID`). If these variables contain malicious characters (such as double quotes, backticks, or shell metacharacters), they could lead to JSON injection or arbitrary command execution when the `curl` command is executed. This is particularly risky for variables like `USER_ADDRESS` and `PATH_ID` which might originate from user input or external sources without proper sanitization. Ensure all variables interpolated into shell commands, especially JSON payloads, are properly sanitized and escaped. For string values, this means escaping double quotes and backslashes. For numeric values, ensure they are strictly numeric. Consider using a dedicated HTTP client library or a safer method for passing JSON data to `curl`, such as `--data-binary @-` with a here-string or temporary file, to prevent shell interpolation issues. | LLM | SKILL.md:43 | |
| MEDIUM | Sensitive environment variable access: $USER Access to sensitive environment variable '$USER' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/0xterrybit/odos/SKILL.md:62 |
Scan History
Embed Code
[](https://skillshield.io/report/9f3d6f8f713d3a32)
Powered by SkillShield