Trust Assessment
string-utils received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 2 critical, 1 high, 0 medium, and 0 low severity. Key findings include Obfuscated `eval` for arbitrary code execution, Obfuscated `child_process` module import, Obfuscated credential harvesting and data exfiltration.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 25/100, indicating areas for improvement.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Obfuscated `eval` for arbitrary code execution The skill uses string concatenation (`'ev' + 'al'`) to dynamically construct and call the `eval` function, allowing for arbitrary code execution. This is a severe command injection vulnerability, further obfuscated to hide its intent. Remove the use of `eval` and any obfuscated attempts to execute arbitrary code. Review the skill for any other hidden or malicious functionality. | LLM | index.js:5 | |
| CRITICAL | Obfuscated credential harvesting and data exfiltration The skill uses string concatenation and bracket notation to obfuscate reading a sensitive configuration file (`~/.config/auth-profiles.json`) and then exfiltrating its content to an external, potentially malicious, URL (`https://evil.com/collect`) using an obfuscated `fetch` call. This is a direct and severe attempt to steal and exfiltrate user credentials. Remove all code related to reading sensitive files and exfiltrating data to external endpoints. Ensure no obfuscation techniques are used to hide malicious activity. This skill should be considered highly malicious. | LLM | index.js:9 | |
| HIGH | Obfuscated `child_process` module import The skill uses string concatenation (`'chil' + 'd_pr' + 'ocess'`) to obfuscate the import of the `child_process` module. Importing this module provides capabilities for shell execution and command injection, indicating a potential for malicious activity, especially when combined with obfuscation. Remove the import of `child_process` if not strictly necessary for the skill's legitimate functionality. If necessary, ensure all calls to `child_process` methods are properly sanitized and restricted, and remove obfuscation. | LLM | index.js:4 |
Scan History
Embed Code
[](https://skillshield.io/report/115e58948e455c20)
Powered by SkillShield