Trust Assessment
url2pdf received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unsanitized URL in shell command leads to command injection, Arbitrary file write via user-controlled output path.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Unsanitized URL in shell command leads to command injection The `SKILL.md` file instructs the agent to execute a shell command `uv run --script ${baseDir}/url2pdf.py "${url}"` where the user-provided `url` is directly interpolated without proper sanitization or shell escaping. This allows an attacker to inject arbitrary shell commands by crafting a malicious URL (e.g., `http://example.com; rm -rf /`). When the agent executes this command, the injected shell commands will be run. The `url` argument must be properly escaped for shell execution before being passed to `uv run`. A more robust solution would be to avoid direct shell interpolation of user input by using a safer method to pass arguments to the script, if available, or by ensuring the agent's execution environment automatically escapes arguments. | LLM | SKILL.md:26 | |
| HIGH | Arbitrary file write via user-controlled output path The `url2pdf.py` script allows users to specify an arbitrary output path for the generated PDF via the `-o` or `--output` command-line argument. The script resolves this path using `Path(output).expanduser().resolve()`, which means the agent can be instructed to write files to any location on the filesystem where it has write permissions. This could lead to overwriting critical system files, placing malicious executables, or filling up disk space in sensitive directories. Restrict the output directory to a predefined, secure location (e.g., a temporary directory or a user-specific output folder). Do not allow arbitrary paths from user input. If user-defined subdirectories are needed, ensure they are relative to a secure base path and properly sanitized to prevent directory traversal. | LLM | url2pdf.py:60 |
Scan History
Embed Code
[](https://skillshield.io/report/73a1f4770aa32abb)
Powered by SkillShield