Trust Assessment
security-scanner received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential for Command Injection via User-Provided Target, Skill utilizes powerful network scanning tools.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Potential for Command Injection via User-Provided Target The skill's core functionality involves executing external shell commands (`nmap`, `nuclei`, `sslscan`, `nikto`, `testssl.sh`) where the `TARGET` or `SUBNET` is expected to be provided by the user. If the LLM does not rigorously sanitize user input before substituting it into these commands, a malicious user could inject arbitrary shell commands, leading to remote code execution on the host system. This is a direct and high-impact vulnerability. The LLM orchestrating this skill must implement robust input sanitization and validation for all user-provided variables (e.g., `TARGET`, `SUBNET`) before constructing and executing shell commands. Consider using an allowlist for valid target formats or escaping all special shell characters to prevent injection. | LLM | SKILL.md:12 | |
| HIGH | Skill utilizes powerful network scanning tools The skill is designed to use advanced network and security scanning tools (`nmap`, `nuclei`, `nikto`, `sslscan`, `testssl.sh`). These tools can perform broad network reconnaissance, port scanning, vulnerability detection, and potentially intrusive actions. While aligned with the skill's stated purpose, granting an AI agent the ability to execute such tools without strict controls on target authorization and scope poses a significant risk of misuse, including unauthorized scanning of internal networks or external systems. The 'Ethics' section acknowledges these risks, but the capability itself is powerful and requires careful management. Implement strict access controls and authorization mechanisms for the AI agent invoking this skill. Ensure that the agent is only permitted to scan explicitly authorized targets and that all scanning activities are logged and auditable. Consider sandboxing the execution environment for these tools to limit their potential impact and prevent unauthorized network access. | LLM | SKILL.md:12 |
Scan History
Embed Code
[](https://skillshield.io/report/72c24c7e8a6b4c0f)
Powered by SkillShield