Trust Assessment
bitaxe-monitor received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Suspicious import: urllib.request, Server-Side Request Forgery (SSRF) via Unvalidated IP Address.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Server-Side Request Forgery (SSRF) via Unvalidated IP Address The script constructs a URL using an IP address that can be provided by the user via command-line arguments, a configuration file, or an environment variable. This IP address is directly embedded into the URL for `urllib.request.urlopen` without validation or sanitization. An attacker could provide a malicious IP or hostname (e.g., an internal IP, a cloud metadata endpoint, or a URL with path traversal characters) to force the skill to make requests to arbitrary internal or external services, potentially leading to information disclosure, port scanning, or interaction with internal systems. Implement robust validation for the `ip` variable before it is used to construct the URL. Ensure the input is a valid IP address or hostname and does not contain any characters that could manipulate the URL path or scheme. Consider using a dedicated library for URL validation or restricting the allowed IP ranges if the skill is intended for local network devices only. | LLM | scripts/bitaxe_status.py:70 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/pietro395/bitaxe-monitor/scripts/bitaxe_status.py:17 |
Scan History
Embed Code
[](https://skillshield.io/report/700168ca4bd8b323)
Powered by SkillShield