Trust Assessment
youtrack received a trust score of 73/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via User Input to Custom CLI Tool.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Potential Command Injection via User Input to Custom CLI Tool The skill defines a custom CLI tool `ytctl` (located in `scripts/`) that accepts user-provided strings as arguments for various commands, such as issue summaries, comments, and search queries. The skill's manifest also indicates a dependency on `jq` and `curl`, which are commonly used in shell scripts. If the `ytctl` script is implemented as a shell script and does not properly sanitize or quote these user-supplied arguments before interpolating them into internal shell commands, it could be vulnerable to command injection. An attacker could craft malicious input (e.g., `'; rm -rf /'`) that, when passed to `ytctl` by the LLM, would execute arbitrary commands on the host system. The `ytctl` script must be thoroughly reviewed and updated to ensure all user-supplied arguments are properly escaped or quoted when used in shell commands. For shell scripts, this typically involves using `printf %q` for arguments or ensuring that arguments are passed as separate elements to `exec` functions in other programming languages to prevent shell metacharacter interpretation. | LLM | SKILL.md:30 |
Scan History
Embed Code
[](https://skillshield.io/report/a6b1de3461067964)
Powered by SkillShield