skills/rshade/agent-skills/shellcheck/Gen Agent Trust Hub

shellcheck

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PRIVILEGE_ESCALATION]: The skill includes instructions to install the Shellcheck utility using sudo via apt-get or snap. It also suggests installing the binary directly into /usr/local/bin, a system-level directory.\n- [EXTERNAL_DOWNLOADS]: The skill provides a command to download the latest Shellcheck release directly from the official GitHub repository (api.github.com/repos/koalaman/shellcheck).\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests shell scripts from the project environment to perform validation, which could allow malicious content within those scripts to influence the agent's behavior.\n
  • Ingestion points: Shell scripts (*.sh) found in the project directory.\n
  • Boundary markers: The skill does not implement specific delimiters or safety instructions to prevent the agent from following directions embedded in script comments.\n
  • Capability inventory: The skill uses find to discover files and shellcheck to process them.\n
  • Sanitization: No sanitization or filtering is applied to the script content before it is processed for validation.\n- [COMMAND_EXECUTION]: The skill executes the shellcheck binary on files detected within the project workspace.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 12:27 AM
Security Audit — agent-trust-hub — shellcheck