Trust Assessment
todo-tracker received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Arbitrary File Access via TODO_FILE environment variable, Regular Expression Denial of Service (ReDoS) via user input.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Access via TODO_FILE environment variable The `TODO_FILE` variable is initialized from the environment (`TODO_FILE="${TODO_FILE:-TODO.md}"`). If a malicious actor can control the `TODO_FILE` environment variable, they can direct the script to read, modify, or delete arbitrary files on the system. This could lead to data exfiltration (e.g., `cat /etc/passwd` if `TODO_FILE` is set to `/etc/passwd`) or data corruption/deletion (e.g., `sed -i` operations on sensitive files). This is particularly concerning as the `SKILL.md` explicitly shows `cat TODO.md` as a command, and the script itself uses `TODO_FILE` in `cat`, `grep`, `sed`, `awk`, and `mv` operations. Do not allow `TODO_FILE` to be set via environment variables. Hardcode the path or derive it from a secure, non-user-controlled source within the skill's designated workspace. For example, `TODO_FILE="$SKILL_WORKSPACE/TODO.md"` if `SKILL_WORKSPACE` is a trusted variable. | LLM | scripts/todo.sh:9 | |
| MEDIUM | Regular Expression Denial of Service (ReDoS) via user input The `mark_done` and `remove_item` functions use user-provided `$pattern` directly within regular expressions for `grep` and `sed`. A maliciously crafted, complex, or pathological regex pattern (e.g., `(a+)+b`) could consume excessive CPU resources, leading to a denial of service for the skill or the underlying system. Implement input validation and sanitization for user-provided patterns. If full regex capabilities are required, consider using a regex engine with built-in protections against ReDoS, or limit the complexity of allowed patterns. For simple string matching, use `grep -F` (fixed strings) instead of `grep` (regex) and escape special characters for `sed` if using fixed strings. | LLM | scripts/todo.sh:65 |
Scan History
Embed Code
[](https://skillshield.io/report/16474c3a92f36585)
Powered by SkillShield