Trust Assessment
agentmail-wrapper received a trust score of 84/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 0 high, 2 medium, and 1 low severity. Key findings include Missing required field: name, Node lockfile missing, Unpinned dependency in installation instructions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/shepherd217/agentmail-wrapper/SKILL.md:1 | |
| MEDIUM | Unpinned dependency in installation instructions The installation instructions in `SKILL.md` recommend installing the `agentmail-wrapper` package without specifying a version (`npm install agentmail-wrapper` or `pip install agentmail-wrapper`). This means users will always fetch and install the latest available version from the package registry. If a malicious update is published to the npm or PyPI registry, users could unknowingly install compromised code, leading to supply chain attacks. Specify a pinned version in the installation instructions to ensure reproducible and secure installations. For example, `npm install agentmail-wrapper@1.0.0` or `pip install agentmail-wrapper==1.0.0`. Additionally, consider providing a lock file (e.g., `package-lock.json` for npm, `requirements.txt` for pip) for more robust dependency management. | LLM | SKILL.md:48 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/shepherd217/agentmail-wrapper/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/60eaa774253cfeef)
Powered by SkillShield