Trust Assessment
revenue-calculator received a trust score of 81/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Direct JSON parsing from command-line argument.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Direct JSON parsing from command-line argument The `scripts/revenue-calc.py` script directly parses `sys.argv[1]` as JSON. In an AI agent context, if the LLM constructs the command-line argument using untrusted user input without proper shell escaping, an attacker could inject malicious shell commands. While the script itself does not `eval` or `exec` JSON values, the method of input delivery (command-line argument) is a common command injection vector if the caller (LLM) does not sanitize the input string before execution. To mitigate this risk, consider passing JSON input via standard input (stdin) instead of command-line arguments, which avoids shell escaping complexities. If command-line arguments are necessary, ensure the LLM strictly quotes and escapes the JSON string before passing it to the shell. Additionally, implement robust input validation within the script to ensure only expected data types and structures are processed. | LLM | scripts/revenue-calc.py:15 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/twood2024/revenue-calculator/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/384140627aa3f94d)
Powered by SkillShield