Trust Assessment
pr-reviewer received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 2 critical, 0 high, 0 medium, and 0 low severity. Key findings include Command Injection via Environment Variable in Python Execution, Command Injection via Environment Variable in Python Execution (Report Path).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection via Environment Variable in Python Execution The `scripts/pr-review.sh` script directly interpolates the `$STATE_FILE` variable into a Python string literal within a `python3 -c` command. `$STATE_FILE` is derived from the `PR_REVIEW_STATE` environment variable, which can be controlled by an attacker. By crafting a malicious value for `PR_REVIEW_STATE` (e.g., `'; import os; os.system("malicious_command"); #`), an attacker can break out of the Python string literal and execute arbitrary Python code, leading to command injection on the host system. This affects both the `is_reviewed` and `update_state` functions. Avoid direct interpolation of untrusted variables into `python3 -c` commands. Instead, pass variables as arguments to the Python script (e.g., `python3 script.py "$STATE_FILE"`) and parse them using `sys.argv`. Alternatively, use `shlex.quote` for shell arguments or ensure proper validation and sanitization of file paths before use. | LLM | scripts/pr-review.sh:78 | |
| CRITICAL | Command Injection via Environment Variable in Python Execution (Report Path) Similar to the `$STATE_FILE` vulnerability, the `$REVIEWS_DIR` variable is directly interpolated into a Python string literal within the `update_state` function's `python3 -c` command. `$REVIEWS_DIR` is derived from the `PR_REVIEW_OUTDIR` environment variable. An attacker can craft a malicious value for `PR_REVIEW_OUTDIR` (e.g., `'; import os; os.system("malicious_command"); #`) to inject and execute arbitrary Python code on the host system. Avoid direct interpolation of untrusted variables into `python3 -c` commands. Instead, pass variables as arguments to the Python script (e.g., `python3 script.py "$REVIEWS_DIR"`) and parse them using `sys.argv`. Alternatively, use `shlex.quote` for shell arguments or ensure proper validation and sanitization of file paths before use. | LLM | scripts/pr-review.sh:90 |
Scan History
Embed Code
[](https://skillshield.io/report/166ade9befc759e3)
Powered by SkillShield