Trust Assessment
pihole received a trust score of 59/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 1 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Sensitive environment variable access: $HOME, Unquoted CURL_FLAGS variable leads to command injection.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Unquoted CURL_FLAGS variable leads to command injection The `CURL_FLAGS` variable is constructed based on the `PIHOLE_INSECURE` setting, which can be controlled via environment variables or the `clawdbot.json` configuration file. The `CURL_FLAGS` variable is then used unquoted in multiple `curl` commands (e.g., lines 70, 89, 95). If an attacker can set `PIHOLE_INSECURE` to a value containing shell metacharacters (e.g., `true; rm -rf /`), these characters will be interpreted by the shell, leading to arbitrary command execution. Quote the `CURL_FLAGS` variable when it is used in `curl` commands to prevent shell expansion of its contents. For example, change `curl $CURL_FLAGS ...` to `curl "$CURL_FLAGS" ...`. This should be applied to all `curl` calls using `$CURL_FLAGS`. | LLM | pihole.sh:70 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/baanish/pihole/SKILL.md:1 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/baanish/pihole/pihole.sh:15 |
Scan History
Embed Code
[](https://skillshield.io/report/510e28e531c93681)
Powered by SkillShield