fn-fpk

github.com/clawhub.ai/fn-fpk
Verdict: Generally safe
0 critical2 high1 medium
B
SCORE 75 / 100
$skillox install fn-fpkSoon
Sign in to followFollowing emails you when a re-scan drops the grade. Opt-out is per-creator on /account/billing.

Why grade B?

score · 75 / 100

The current grade reflects 2 high-severity findings (any HIGH → B).

0 CRIT2 HIGH1 MED0 LOW
To reach a higher grade
  • A
    Reach Atarget score 95

    Resolve all 2 HIGH.

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Latest scan findings

Scan crawl-w4o4g46yxzdk4g3azf3qrbv6 · Thu, 28 May 2026 15:52:06 GMT · 15ms

high
Shell-injection vector: bash -c with template-string interpolation
The skill constructs a shell command by interpolating into a string passed to an exec-family function (`bash -c with template-string interpolation`). If the interpolated value comes from agent context or user input, this is direct command injection. Use parameterized APIs (`spawn` with an arg-array, `subprocess.run([...])` without `shell=True`).
rule: shell-injection-templateline: 791CWE-78
▾
789start_process() {
790 kill_old
791 bash -c "${CMD}" >> ${LOG_FILE} 2>&1 &← bash -c with template-string interpolation — use a parameterized API instead
792 printf "%s" "$!" > ${PID_FILE}
793 local port=${TRIM_SERVICE_PORT:-8080}
high
Shell-injection vector: bash -c with template-string interpolation
The skill constructs a shell command by interpolating into a string passed to an exec-family function (`bash -c with template-string interpolation`). If the interpolated value comes from agent context or user input, this is direct command injection. Use parameterized APIs (`spawn` with an arg-array, `subprocess.run([...])` without `shell=True`).
rule: shell-injection-templateline: 795CWE-78
▾
793 local port=${TRIM_SERVICE_PORT:-8080}
794 for i in $(seq 1 15); do
795 if bash -c "echo > /dev/tcp/127.0.0.1/${port}" 2>/dev/null; then← bash -c with template-string interpolation — use a parameterized API instead
796 echo "Service ready on port ${port}" >> ${LOG_FILE}
797 return 0
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
View latest scan →
skillox.io/c/fn-fpk