Trust Assessment
sales received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 0 critical, 1 high, 3 medium, and 0 low severity. Key findings include Sensitive environment variable access: $HOME, Command Injection via unsanitized grep argument.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via unsanitized grep argument The `search` command in `scripts/lead-tracker.sh` directly uses user-provided input (`$2`) as an argument to `grep -l -r`. This allows an attacker to inject arbitrary shell commands by crafting the search term with shell metacharacters (e.g., `'; rm -rf /'`). When the script executes `grep -l -r "$2" "$LEADS_DIR"`, the shell will interpret and execute any commands embedded within `$2` before passing the result to `grep`. Sanitize user input before passing it to shell commands. For `grep`, use the `-F` option to treat the pattern as a fixed string, and ensure the argument is properly quoted. For example, change `grep -l -r "$2" "$LEADS_DIR"` to `grep -l -r -F -- "$2" "$LEADS_DIR"`. The `--` ensures that `$2` is not interpreted as an option, and `-F` prevents regex interpretation. | LLM | scripts/lead-tracker.sh:74 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/oyi77/sales/scripts/lead-tracker.sh:5 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/oyi77/sales/scripts/pipeline-report.sh:5 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/oyi77/sales/scripts/sales-init.sh:5 |
Scan History
Embed Code
[](https://skillshield.io/report/40ca9c6d7886219b)
Powered by SkillShield