Trust Assessment
pltr-cli received a trust score of 81/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Exposure of interactive shell mode (`pltr shell`).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Exposure of interactive shell mode (`pltr shell`) The skill documents the `pltr shell` command, which launches an interactive shell for the `pltr-cli`. If the host LLM is prompted to enter this interactive mode and subsequently passes untrusted user input directly into the `pltr` shell, it could lead to arbitrary command execution on the underlying system. This bypasses the LLM's usual command sanitization and validation layers, creating a direct command injection vector. Avoid exposing interactive shell commands directly to the LLM. If interactive mode is deemed necessary, ensure the LLM has robust input validation and sanitization before passing commands to the shell, or implement a wrapper that restricts available commands and arguments. Alternatively, explicitly instruct the LLM *not* to enter interactive shell mode or to only use specific, pre-approved commands within it. | LLM | SKILL.md:122 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/anjor/pltr-cli/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/bfbb0e61a36f0f57)
Powered by SkillShield