Trust Assessment
onemind-skill received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Sensitive environment variable access: $USER, Unsafe shell parsing of API responses leading to command injection.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsafe shell parsing of API responses leading to command injection The `test_submit_ratings.sh` script parses JSON responses from the Supabase API using `grep` and `cut`. The extracted values, such as `ACCESS_TOKEN` and `USER_ID`, are then directly interpolated into subsequent `curl` commands without proper sanitization or quoting. If a malicious Supabase API (or an attacker-controlled proxy) were to return a response containing shell metacharacters within these fields, it could lead to arbitrary command execution on the host system running the script. Use a robust JSON parser like `jq` to safely extract values from API responses. Ensure all variables interpolated into shell commands are properly quoted (e.g., `"$VAR"`) and/or sanitized to prevent shell metacharacters from being interpreted as commands. For example, `ACCESS_TOKEN=$(echo "$AUTH_RESP" | jq -r '.access_token')` and then `curl ... -H "Authorization: Bearer \"$ACCESS_TOKEN\""`. | LLM | test_submit_ratings.sh:26 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/onemindlife/onemind-skill/SKILL.md:1 | |
| MEDIUM | Sensitive environment variable access: $USER Access to sensitive environment variable '$USER' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/onemindlife/onemind-skill/test_submit_ratings.sh:30 |
Scan History
Embed Code
[](https://skillshield.io/report/ad8599726c2480ff)
Powered by SkillShield