Trust Assessment
Preisrunter Grocery Search API received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via unsanitized user input in curl arguments.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via unsanitized user input in curl arguments The skill's API examples demonstrate constructing `curl` commands by directly interpolating user-controlled query parameters (e.g., `q`, `region`, `shops`) into the URL string. If the LLM implements this pattern by directly concatenating user input without proper sanitization or escaping, a malicious user could inject shell metacharacters (e.g., `&`, `|`, `;`, `$()`, `` ` ``) into these parameters. This could lead to arbitrary command execution on the host system, allowing data exfiltration, system modification, or denial of service. The manifest confirms the use of `curl` and `jq` binaries, indicating shell execution. The LLM's implementation for calling `curl` must properly sanitize and escape all user-provided input before incorporating it into the command string. Alternatively, use `curl`'s `-G` and `--data-urlencode` options for query parameters, or use a robust HTTP client library that handles URL encoding and command construction securely, preventing shell interpretation of user input. | LLM | skill.md:40 |
Scan History
Embed Code
[](https://skillshield.io/report/5649face8aef2af3)
Powered by SkillShield