Trust Assessment
talent-powers received a trust score of 88/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via unsanitized user input in shell command examples.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via unsanitized user input in shell command examples The skill documentation provides `curl` examples and GitHub API call patterns that include placeholders for user input (e.g., `{handle}`, `{username}`). If the LLM directly constructs and executes shell commands (like `curl` or similar HTTP requests) by interpolating untrusted user input into these placeholders without proper shell escaping or URL encoding, it could lead to command injection. An attacker could inject shell metacharacters (e.g., `;`, `&`, `|`, `` ` ``) into these input values to execute arbitrary commands on the host system. The LLM's tool execution environment must ensure that all user-provided inputs interpolated into shell commands are properly sanitized and shell-escaped. For URL parameters, this includes URL encoding. A safer approach is to use a dedicated HTTP client library (e.g., `requests` in Python) to construct and send API requests, as these libraries handle parameter encoding and command construction securely, avoiding direct shell execution for API calls. | LLM | SKILL.md:30 |
Scan History
Embed Code
[](https://skillshield.io/report/29a66c642997790c)
Powered by SkillShield