Trust Assessment
tg-voice-whisper received a trust score of 60/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 1 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Command Injection via unsanitized input in 'exec' command, Unpinned dependency in pip installation.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 63/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection via unsanitized input in 'exec' command The 'exec' command directly interpolates the 'PATH' variable (likely the path to the inbound .ogg file) into a shell command string without proper sanitization or escaping. If 'PATH' originates from untrusted user input (e.g., a maliciously crafted filename), an attacker can inject arbitrary shell commands. This allows for arbitrary code execution, data exfiltration, or system modification with the privileges of the executing agent. The `rm PATH` command is also vulnerable to similar injection. Avoid direct interpolation of untrusted input into shell commands. Use a safer command execution mechanism (e.g., `subprocess.run` with `shell=False` and arguments as a list) or rigorously sanitize and escape all untrusted variables (e.g., using `shlex.quote()` in Python) before execution. Ensure the agent runs with the principle of least privilege. | LLM | SKILL.md:23 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/drones277/tg-voice-whisper/SKILL.md:1 | |
| MEDIUM | Unpinned dependency in pip installation The 'openai-whisper' package is installed without a specific version constraint. This introduces a supply chain risk, as a future malicious or breaking update to the package could be automatically pulled and installed, potentially compromising the skill or its environment without explicit review. Pin the 'openai-whisper' dependency to a specific, known-good version (e.g., `openai-whisper==X.Y.Z`) to ensure consistent and secure installations. Regularly review and update pinned dependencies. | LLM | SKILL.md:13 |
Scan History
Embed Code
[](https://skillshield.io/report/5743a46a1babadb1)
Powered by SkillShield