Trust Assessment
time-tracker received a trust score of 66/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Potential Command Injection via unsanitized user input.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Potential Command Injection via unsanitized user input The skill description indicates that user-provided arguments for commands like `start <project> [task]` and `delete <entry-id>` are processed. The 'Implementation' section also explicitly mentions using shell commands (e.g., `date -Iseconds` on line 49). If these user inputs (`project`, `task`, `entry-id`) are directly interpolated into shell commands without proper sanitization, an attacker could inject arbitrary shell commands. This could lead to remote code execution, data deletion, or system compromise, effectively escalating the skill's intended filesystem access to arbitrary system access. All user-provided inputs (e.g., `project`, `task`, `entry-id`) must be strictly validated and sanitized before being used in any shell command. Prefer using safe APIs that avoid shell interpretation (e.g., `subprocess.run` with `shell=False` in Python, or carefully escaping arguments). If shell execution is unavoidable, ensure all arguments are properly quoted and escaped to prevent injection. | LLM | SKILL.md:25 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/sa9saq/time-tracker/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/933ceabd5414a6e1)
Powered by SkillShield