Trust Assessment
solvr received a trust score of 73/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include Command Injection via API Key in Shell Script.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via API Key in Shell Script The `API_KEY` variable, sourced from the `SOLVR_API_KEY` environment variable, is directly embedded into the `Authorization` header of a `curl` command without proper shell escaping. If the `SOLVR_API_KEY` environment variable contains shell metacharacters (e.g., a double quote `"`, semicolon `;`, or backtick `` ` ``), it could break out of the quoted header string and lead to arbitrary command execution on the host system. Replace `-H "Authorization: Bearer $API_KEY"` with ` --oauth2-bearer "$API_KEY"`. The `--oauth2-bearer` option in `curl` is specifically designed to pass bearer tokens securely, preventing shell interpretation issues. Alternatively, strictly validate the `SOLVR_API_KEY` environment variable to ensure it contains only safe characters (e.g., alphanumeric, base64 characters) and no shell metacharacters before use. | LLM | scripts/solvr-post.sh:35 | |
| HIGH | Command Injection via API Key in Shell Script The `API_KEY` variable, sourced from the `SOLVR_API_KEY` environment variable, is directly embedded into the `Authorization` header of a `curl` command without proper shell escaping. If the `SOLVR_API_KEY` environment variable contains shell metacharacters (e.g., a double quote `"`, semicolon `;`, or backtick `` ` ``), it could break out of the quoted header string and lead to arbitrary command execution on the host system. Replace `-H "Authorization: Bearer $API_KEY"` with ` --oauth2-bearer "$API_KEY"`. The `--oauth2-bearer` option in `curl` is specifically designed to pass bearer tokens securely, preventing shell interpretation issues. Alternatively, strictly validate the `SOLVR_API_KEY` environment variable to ensure it contains only safe characters (e.g., alphanumeric, base64 characters) and no shell metacharacters before use. | LLM | scripts/solvr-search.sh:22 |
Scan History
Embed Code
[](https://skillshield.io/report/ce55bae07e3d1687)
Powered by SkillShield