Trust Assessment
piv received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 5 findings: 3 critical, 2 high, 0 medium, and 0 low severity. Key findings include Command Injection via unsanitized PROJECT_PATH in mkdir, Command Injection via unsanitized PROJECT_PATH in ls, Command Injection via unsanitized PROJECT_PATH in cd.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 0/100, indicating areas for improvement.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection via unsanitized PROJECT_PATH in mkdir The `PROJECT_PATH` variable, which is derived from user input (`$ARGUMENTS[0]`), is directly interpolated into a `mkdir -p` shell command without proper sanitization or quoting. A malicious user can inject shell metacharacters (e.g., `;`, `&`, `|`, `$(...)`) into `PROJECT_PATH` to execute arbitrary commands on the host system. Sanitize or escape `PROJECT_PATH` before using it in shell commands. Prefer using a safe API for directory creation that handles path components securely, or ensure the shell command uses proper quoting (e.g., `mkdir -p "$PROJECT_PATH"/PRDs`). | LLM | SKILL.md:100 | |
| CRITICAL | Command Injection via unsanitized PROJECT_PATH in ls The `PROJECT_PATH` variable, derived from user input (`$ARGUMENTS[0]`), is directly interpolated into an `ls -la` shell command without proper sanitization or quoting. This allows for command injection if `PROJECT_PATH` contains shell metacharacters, potentially leading to arbitrary command execution or information disclosure. Sanitize or escape `PROJECT_PATH` before using it in shell commands. Use a safe API for listing directories or ensure proper quoting (e.g., `ls -la "$PROJECT_PATH"/PRPs/`). | LLM | SKILL.md:110 | |
| CRITICAL | Command Injection via unsanitized PROJECT_PATH in cd The `PROJECT_PATH` variable, derived from user input (`$ARGUMENTS[0]`), is directly interpolated into a `cd` shell command without proper sanitization or quoting. This allows for command injection if `PROJECT_PATH` contains shell metacharacters, potentially leading to arbitrary command execution. Sanitize or escape `PROJECT_PATH` before using it in shell commands. Ensure proper quoting (e.g., `cd "$PROJECT_PATH"`). | LLM | SKILL.md:180 | |
| HIGH | Prompt Injection via User-Controlled Variables in Sub-Agent Prompts The skill constructs prompts for sub-agents by embedding variables such as `{PROJECT_PATH}`, `{PRD_PATH}`, `{PRD_NAME}`, and content from files (e.g., 'paste phase scope from PRD'). Since `PROJECT_PATH`, `PRD_PATH`, and the content of PRD/PRP files can be influenced or directly controlled by user input (via `$ARGUMENTS` or crafted files), a malicious user could inject instructions into these variables/content to manipulate the behavior of the spawned sub-agents. This could lead to data exfiltration, unintended actions, or privilege escalation if the sub-agents have access to sensitive tools. Implement strict sanitization and escaping for all user-controlled input and file content before embedding it into sub-agent prompts. Consider using structured data for communication with sub-agents instead of raw text interpolation, or employ techniques like prompt templating engines that automatically escape variables. Ensure that any content pasted from files is treated as data, not instructions, by the sub-agent. | LLM | SKILL.md:120 | |
| HIGH | Data Exfiltration Risk via Combined Command and Prompt Injection The presence of critical command injection vulnerabilities (allowing arbitrary file reads) combined with prompt injection vulnerabilities (allowing sub-agents to be instructed to output arbitrary data) creates a high risk of data exfiltration. A malicious actor could craft inputs to read sensitive files from the system (e.g., `/etc/passwd`, API keys, configuration files) and then instruct a sub-agent to include this content in its output, effectively exfiltrating the data. Address all underlying command injection and prompt injection vulnerabilities. Implement strict input validation and sanitization. Limit the scope of file system access for the skill and its sub-agents to only necessary directories. Ensure sub-agents are sandboxed and cannot access arbitrary files or network resources. | LLM | SKILL.md:100 |
Scan History
Embed Code
[](https://skillshield.io/report/0d5a9d5a9e4624de)
Powered by SkillShield