Trust Assessment
trmnl-display received a trust score of 66/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Potential Command Injection via `curl` execution.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Potential Command Injection via `curl` execution The skill instructs the LLM to 'Send the webhook using the curl command above'. If the LLM constructs and executes this `curl` command by directly interpolating user-provided `title` or `text` into the shell command string, it creates a command injection vulnerability. A malicious user could craft input that breaks out of the JSON string and executes arbitrary shell commands on the host system. Instruct the LLM to use a safe, programmatic HTTP client (e.g., Python's `requests` library, or a built-in `fetch` equivalent) to make the POST request. Ensure that user-provided data is passed as a JSON payload and not interpolated directly into a shell command string. If `curl` must be used, explicitly instruct the LLM to properly escape all user-provided input before inclusion in the command string, though a programmatic approach is generally more secure. | LLM | SKILL.md:70 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/peetzweg/trmnl-display/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/c1b1962a7582352c)
Powered by SkillShield