Security Audit
Jamkris/everything-gemini-code:skills/claude-api
github.com/Jamkris/everything-gemini-codeTrust Assessment
Jamkris/everything-gemini-code:skills/claude-api received a trust score of 70/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 0 medium, and 0 low severity. Key findings include Unpinned Dependencies in Installation Instructions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on March 30, 2026 (commit 6c6f43aa). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| INFO | Unpinned Dependencies in Installation Instructions The skill provides installation instructions for `anthropic` (Python) and `@anthropic-ai/sdk` (TypeScript) without specifying version pins. While common in quick-start guides, this practice can lead to unexpected breaking changes or security vulnerabilities if new versions introduce issues. For production applications, it is best practice to pin dependencies to specific versions to ensure reproducibility and stability. Recommend users pin dependency versions in their `requirements.txt` or `package.json` files (e.g., `pip install anthropic==x.y.z` or `npm install @anthropic-ai/sdk@x.y.z`) to mitigate risks from unannounced breaking changes or vulnerabilities in future package versions. | Static | SKILL.md:28 | |
| INFO | Unpinned Dependencies in Installation Instructions The skill provides installation instructions for `anthropic` (Python) and `@anthropic-ai/sdk` (TypeScript) without specifying version pins. While common in quick-start guides, this practice can lead to unexpected breaking changes or security vulnerabilities if new versions introduce issues. For production applications, it is best practice to pin dependencies to specific versions to ensure reproducibility and stability. Recommend users pin dependency versions in their `requirements.txt` or `package.json` files (e.g., `pip install anthropic==x.y.z` or `npm install @anthropic-ai/sdk@x.y.z`) to mitigate risks from unannounced breaking changes or vulnerabilities in future package versions. | Static | SKILL.md:50 |
Scan History
Embed Code
[](https://skillshield.io/report/dcfae2f3fd82ae59)
Powered by SkillShield