Trust Assessment
umea-data received a trust score of 66/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 2 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Command Injection via unsanitized dataset_id in nearby.sh, Command Injection via unsanitized dataset_id and limit in query.sh.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via unsanitized dataset_id in nearby.sh The `DATASET_ID` variable, which is derived directly from the first command-line argument (`$1`), is interpolated directly into a `curl` command without any sanitization or escaping. This allows for command injection, where a malicious user could provide a `DATASET_ID` containing shell metacharacters (e.g., `;`, `|`, `&`, `$(...)`) to execute arbitrary commands on the system running the script, or manipulate the URL in unintended ways. Sanitize or escape the `DATASET_ID` variable before using it in the `curl` command. A safer approach would be to use `printf %q` for shell arguments or ensure the `curl` command is constructed in a way that prevents shell interpretation of the variable's content. For URL parameters, proper URL encoding should be applied. | LLM | scripts/nearby.sh:26 | |
| HIGH | Command Injection via unsanitized dataset_id and limit in query.sh The `DATASET_ID` and `LIMIT` variables, derived directly from command-line arguments (`$1`, `$2`), are interpolated directly into a `curl` command without any sanitization or escaping. This allows for command injection, where a malicious user could provide inputs containing shell metacharacters (e.g., `;`, `|`, `&`, `$(...)`) to execute arbitrary commands on the system running the script, or manipulate the URL in unintended ways. Sanitize or escape the `DATASET_ID` and `LIMIT` variables before using them in the `curl` command. A safer approach would be to use `printf %q` for shell arguments or ensure the `curl` command is constructed in a way that prevents shell interpretation of the variable's content. For URL parameters, proper URL encoding should be applied. | LLM | scripts/query.sh:28 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/simskii/umea-data/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/2567d14a9e6d1b5b)
Powered by SkillShield