Trust Assessment
weathercli received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Potential Command Injection via unsanitized user input in `weathercli` arguments, Supply Chain Risk: Unpinned dependency in installation instructions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via unsanitized user input in `weathercli` arguments The skill instructs the LLM to execute `weathercli` commands, passing user-provided location strings as arguments. If the LLM directly interpolates untrusted user input into the `<location>` argument without proper shell escaping (e.g., using `shlex.quote` in Python or similar mechanisms), a malicious user could inject arbitrary shell commands. For example, an input like `"London"; rm -rf /;` could be executed if not properly handled. While the `SKILL.md` examples show quoted arguments, the LLM's implementation of command construction is critical here. The LLM agent responsible for executing this skill must ensure that all user-provided arguments passed to `weathercli` are properly shell-escaped before command execution. For example, in Python, `shlex.quote()` should be used to prevent command injection. | LLM | SKILL.md:17 | |
| MEDIUM | Supply Chain Risk: Unpinned dependency in installation instructions The installation instructions use `go install github.com/pjtf93/weathercli/cmd/weathercli@latest`. Using `@latest` means that the skill's functionality relies on the most recent version of the `weathercli` tool, which could change at any time. This introduces a supply chain risk, as a new version might introduce breaking changes, vulnerabilities, or even malicious code without explicit review. Pin the dependency to a specific, known-good version (e.g., `go install github.com/pjtf93/weathercli/cmd/weathercli@v1.2.3`) to ensure deterministic and secure installations. Regularly review and update the pinned version. | LLM | SKILL.md:204 |
Scan History
Embed Code
[](https://skillshield.io/report/7e10d7b75d6b89a0)
Powered by SkillShield