Trust Assessment
train-sentence-transformers received a trust score of 76/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Suspicious unreferenced dependency 'trackio' recommended and included in scripts.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on July 1, 2026 (commit 35e8c35a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Suspicious unreferenced dependency 'trackio' recommended and included in scripts The package 'trackio' is listed as a dependency in the metadata of multiple training scripts and recommended in SKILL.md as an ML tracker. However, 'trackio' on PyPI is a trajectory processing library, not an ML tracker, and it is never imported or used in the scripts. Furthermore, 'report_to="trackio"' is not a supported integration in Hugging Face TrainingArguments. This represents a supply chain risk where an unrelated or potentially malicious package is installed automatically during script execution. Remove 'trackio' from the dependencies list in all scripts and SKILL.md. Use standard, verified ML tracking libraries such as 'wandb', 'tensorboard', or 'mlflow' instead. | LLM | SKILL.md:111 |
Scan History
Embed Code
[](https://skillshield.io/report/87992648fc79f802)
Powered by SkillShield