Trust Assessment
botcoin-miner received a trust score of 94/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Untrusted Binary Download and Execution.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Untrusted Binary Download and Execution The skill instructs the agent to download and execute binaries (`botcoind`, `botcoin-cli`) from an external GitHub repository. While a `sha256sum` verification step is included, this check relies on the integrity of the `SHA256SUMS` file provided by the *same* source. If the GitHub release is compromised, both the binaries and their checksums could be maliciously altered, leading to the execution of arbitrary untrusted code on the agent's system. This represents a supply chain risk where the integrity of the upstream source is critical. Implement stronger supply chain security measures. This could include: 1. **Cryptographic Signatures**: Verify binaries using GPG or other cryptographic signatures from a trusted key, rather than just a checksum from the same source. 2. **Independent Verification**: Obtain checksums or signatures from a separate, trusted channel (e.g., a security audit report, a different website). 3. **Reproducible Builds**: Encourage users to build from source and verify the build process. 4. **Sandboxing**: Execute downloaded binaries in a sandboxed environment with minimal permissions. | LLM | SKILL.md:41 |
Scan History
Embed Code
[](https://skillshield.io/report/1c891a51c297af30)
Powered by SkillShield