Trust Assessment
create-pr received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via unsanitized user input in GitHub CLI commands.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via unsanitized user input in GitHub CLI commands The skill provides templates for `gh pr create` and `gh api` commands that include placeholders for user-provided content (e.g., PR titles, descriptions, repository owner, repository name, and PR number). If an LLM agent directly substitutes untrusted user input into these placeholders without proper shell escaping or validation, an attacker could craft malicious input. This could lead to command injection, allowing the execution of arbitrary shell commands, manipulation of `gh` arguments (e.g., injecting `--data-binary @/etc/passwd` into `gh api` to exfiltrate data), or unauthorized actions on GitHub. For example, injecting a double quote followed by a command into the title placeholder could break out of the quoted string and execute arbitrary code, or injecting additional arguments into the `gh api` command could lead to data exfiltration or unintended API calls. LLM agents implementing this skill must ensure robust input sanitization and shell escaping for all user-provided strings before constructing and executing shell commands. Specifically, placeholders like `<description>`, `{owner}`, `{repo}`, and `PR_NUMBER` must be properly quoted and escaped to prevent shell metacharacters from being interpreted as commands or additional arguments. Consider using `gh`'s programmatic interfaces or libraries if available, which often handle escaping automatically, instead of direct shell command construction. | LLM | SKILL.md:80 |
Scan History
Embed Code
[](https://skillshield.io/report/c3e0ffe0d0ca65b2)
Powered by SkillShield