Trust Assessment
splitxch received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Arbitrary file content exfiltration via script argument.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary file content exfiltration via script argument The `scripts/splitxch.sh` script reads the content of a file specified by its first argument (`$1`) using `cat "$1"`. This content is then assigned to the `PAYLOAD` variable and subsequently sent via `curl` to an external API endpoint (`https://splitxch.com/api/compute/fast`). If a malicious actor can manipulate the host LLM to pass a path to a sensitive file (e.g., `/etc/passwd`, `/proc/self/environ`, or a file containing credentials) as the first argument to this script, the contents of that file will be exfiltrated to the external API. Although the `SKILL.md` suggests the LLM will generate a temporary file path like `/tmp/split-payload.json`, this instruction is part of the untrusted content, making the LLM susceptible to prompt injection that could alter the file path. To prevent arbitrary file content exfiltration, the script should avoid taking a file path as an argument for sensitive data. Instead: 1. **Pass payload via stdin**: Modify the script to always read the JSON payload from stdin (`PAYLOAD=$(cat -)`), and instruct the LLM to pipe the JSON content directly to the script. 2. **Strict path validation**: If a file path must be used, implement strict validation to ensure the path is within an allowed temporary directory and does not contain path traversal sequences (e.g., `..`, `/`). 3. **Least privilege**: Ensure the script runs with minimal necessary file system access permissions. | LLM | scripts/splitxch.sh:10 |
Scan History
Embed Code
[](https://skillshield.io/report/92063cd601d895fc)
Powered by SkillShield