Trust Assessment
istio-traffic-management received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Potential Command Injection via Debugging Commands.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on June 1, 2026 (commit 0818067b). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Potential Command Injection via Debugging Commands The skill document contains explicit `bash` commands in the 'Debugging Commands' section. If an AI agent is configured to execute shell commands found within skill content, this presents a command injection vulnerability. While the provided `istioctl` commands are diagnostic and not inherently malicious, the presence of executable shell commands in untrusted content creates a vector for exploitation. An attacker could potentially craft prompts that lead the agent to execute modified versions of these commands or other arbitrary shell commands, depending on the agent's execution environment and input handling. Avoid including executable shell commands directly within skill documentation if the agent is capable of executing them. If commands are necessary for demonstration, ensure the agent's execution environment strictly sandboxes command execution and prevents any user-controlled input from being interpolated into shell commands. Alternatively, provide these commands as non-executable text or within a dedicated tool interface that validates and sanitizes inputs. | Static | SKILL.md:170 |
Scan History
Embed Code
[](https://skillshield.io/report/3ca31264615a4f51)
Powered by SkillShield