Trust Assessment
reminder received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Potential Command Injection via Cron Job Creation.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via Cron Job Creation The skill description states it will 'Create `cron` jobs for each reminder time'. If user-provided event details (e.g., title, notes) are used to construct the `cron` entry or the script executed by `cron` without proper sanitization and escaping, a malicious user could inject arbitrary shell commands. This could lead to remote code execution, persistence, or privilege escalation depending on the execution context of the skill. Implement robust input sanitization and escaping for all user-provided data before it is used to construct `cron` commands or entries. Consider using a dedicated library or API for `cron` management that handles escaping automatically, rather than direct shell command concatenation. Ensure the `cron` job executes a specific, hardened script with minimal privileges, and that any arguments passed to it are also strictly validated. | LLM | SKILL.md:49 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/ryanhong666/reminder/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/9b97708ea4d5c0dc)
Powered by SkillShield