Trust Assessment
security-reviewer received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Excessive 'Bash' permission declared.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Excessive 'Bash' permission declared The skill declares 'Bash' as an allowed tool in its manifest. This grants the AI agent the ability to execute arbitrary shell commands on the host system. While the skill's purpose (security review, penetration testing) may involve running external tools, granting unrestricted 'Bash' access is a significant security risk. If the agent is compromised (e.g., via prompt injection or misconfiguration), this permission could be exploited for command injection, data exfiltration, or system compromise. The skill's workflow describes activities like 'Automated scan' and 'Active testing' which would leverage this powerful capability, making the broad permission particularly concerning. Restrict 'Bash' usage to a minimal set of predefined, sandboxed commands, or use more specific, less powerful tools if available. Implement strict input validation and sanitization for any arguments passed to shell commands. Consider using a dedicated, sandboxed execution environment for security testing tools. If 'Bash' is absolutely necessary, ensure its use is tightly controlled and audited. | LLM | SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/718f9193bc42c9f9)
Powered by SkillShield