Trust Assessment
aws-advisor received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Command Injection Risk via Shell Piping in Script Usage Examples.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on August 1, 2026 (commit 529b8103). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Command Injection Risk via Shell Piping in Script Usage Examples The utility scripts (including `architecture_validator.py`, `cost_considerations.py`, `generate_diagram.py`, `security_review.py`, and `well_architected_review.py`) contain usage examples in their docstrings that demonstrate piping untrusted text into the script via the shell (e.g., `echo "..." | python script.py`). If the LLM agent follows these examples literally and constructs shell commands using untrusted user input, it can lead to arbitrary command execution on the host system if the input contains shell metacharacters like `;`, `&&`, or `|`. Update the script docstrings and LLM instructions to avoid shell piping of user-controlled input. Instead, recommend writing the input to a temporary file first and reading from it, or passing arguments safely without shell expansion. | LLM | scripts/architecture_validator.py:8 |
Scan History
Embed Code
[](https://skillshield.io/report/56bee8d7c4143517)
Powered by SkillShield