Security Audit
pskoett/pskoett-ai-skills:skills/intent-framed-agent
github.com/pskoett/pskoett-ai-skillsTrust Assessment
pskoett/pskoett-ai-skills:skills/intent-framed-agent received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Direct shell command execution.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on March 3, 2026 (commit 3b2f47cc). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Direct shell command execution The skill instructs the agent to execute a hardcoded shell command (`entire status 2>/dev/null`). While the command itself does not directly incorporate user input, direct shell execution introduces a dependency on the security of the `entire` executable and the integrity of the execution environment. An attacker could potentially compromise the `entire` binary or the system's PATH, leading to unintended command execution or information disclosure if the agent's execution environment is not adequately sandboxed. 1. If possible, avoid direct shell command execution. Use a dedicated API or library call if `entire` provides one. 2. If shell execution is necessary, ensure the agent's execution environment is strictly sandboxed and restricted (e.g., containerized with minimal permissions). 3. Implement robust validation and integrity checks for external executables like `entire`. 4. Evaluate if the `entire status` check is critical for the skill's core functionality, or if a fallback without shell execution is acceptable. | LLM | SKILL.md:81 |
Scan History
Embed Code
[](https://skillshield.io/report/39c74fd6fbbfd45f)
Powered by SkillShield