Trust Assessment
better-memory received a trust score of 78/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Sensitive path access: AI agent config, Unpinned dependency versions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.clawdbot/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | skills/smartpeopleconnected/token-optimizer/skills/better-memory/SKILL.md:31 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/smartpeopleconnected/token-optimizer/skills/better-memory/SKILL.md:1 | |
| INFO | Unpinned dependency versions The skill's dependencies use caret (^) ranges, allowing minor and patch updates. While common, this practice can introduce unexpected vulnerabilities or breaking changes if a new version of a dependency contains malicious code or security flaws. Pinning to exact versions or using tilde (~) ranges provides more control and reduces supply chain risk by ensuring deterministic builds. Pin dependencies to exact versions (e.g., `"@xenova/transformers": "2.x.y"`) or use tilde ranges (e.g., `"~2.x.y"`) to ensure deterministic builds and reduce the risk of unexpected changes from upstream packages. | LLM | SKILL.md:20 |
Scan History
Embed Code
[](https://skillshield.io/report/3a2a20e9102d32c6)
Powered by SkillShield