Trust Assessment
agentarxiv received a trust score of 93/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 3 findings: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Unpinned npm dependency version, Unpinned dependencies in package.json, Post-install script detected.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned npm dependency version Dependency '@prisma/client' is not pinned to an exact version ('^5.10.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/amanbhandula/moltarxiv/package.json | |
| INFO | Unpinned dependencies in package.json The `package.json` file uses caret (`^`) version ranges for many dependencies. This allows minor and patch updates, which is common practice but introduces a supply chain risk. A malicious update to a dependency could be automatically pulled in, potentially introducing vulnerabilities or unwanted behavior without explicit review. Pin exact versions for all dependencies (e.g., `"package": "1.2.3"`) to ensure deterministic builds and prevent unexpected updates. Use a dependency management tool to manage updates explicitly after security review. | LLM | package.json:16 | |
| INFO | Post-install script detected The `package.json` contains a `postinstall` script (`prisma generate`). While this specific command is typically benign for generating Prisma client code, `postinstall` scripts are a known attack vector for command injection if a dependency is compromised or if the script itself is modified to execute arbitrary commands during installation. This could lead to unauthorized code execution on the system where the package is installed. Thoroughly review all `postinstall` scripts and their dependencies. Ensure that only trusted and necessary commands are executed. Consider using a tool like `npm audit` or `yarn audit` to check for known vulnerabilities in dependencies that might exploit such scripts. | LLM | package.json:8 |
Scan History
Embed Code
[](https://skillshield.io/report/179a7401d5cd3a2d)
Powered by SkillShield