Trust Assessment
trakt received a trust score of 84/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 1 low severity. Key findings include Potential Command Injection via User Input in Search Query, Unpinned Dependency in Installation Instructions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via User Input in Search Query The skill describes using `trakt-cli search` which takes a user-provided string as an argument. If the LLM constructs the shell command by directly embedding unescaped user input into the search query, it could lead to command injection. An attacker could craft input like `"; rm -rf /"` to execute arbitrary commands on the host system. The LLM must ensure that any user-provided input passed as an argument to `trakt-cli search` (or any other command taking user input) is properly sanitized and shell-escaped (e.g., by quoting the entire argument or escaping special characters) before execution. | LLM | SKILL.md:35 | |
| LOW | Unpinned Dependency in Installation Instructions The installation instructions `npm install -g trakt-cli` do not specify a version for the `trakt-cli` package. This means that the latest version available at the time of installation will be used. Future versions of the package could introduce vulnerabilities, breaking changes, or even malicious code, posing a supply chain risk. Pin the dependency to a specific, known-good version (e.g., `npm install -g trakt-cli@1.2.3`) to ensure consistent and secure installations. Regularly review and update pinned versions. | LLM | SKILL.md:13 |
Scan History
Embed Code
[](https://skillshield.io/report/3eef913418b99d25)
Powered by SkillShield