Trust Assessment
celo-defi received a trust score of 100/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 0 medium, and 0 low severity. Key findings include Unpinned or Loosely Pinned Dependencies.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| INFO | Unpinned or Loosely Pinned Dependencies The skill specifies dependencies using caret (`^`) ranges, such as `viem: "^2.0.0"` and `@bgd-labs/aave-address-book: "^4.0.0"`. While common, this practice allows for automatic updates to new minor or patch versions. If a new version introduces a vulnerability or breaking change, it could impact the skill's security or functionality without explicit review. Exact pinning (`"2.0.0"`) or tilde (`~`) ranges are generally recommended for production environments to ensure deterministic builds and reduce supply chain risks. Consider pinning dependencies to exact versions (e.g., `"viem": "2.x.y"`) or using tilde ranges (e.g., `"~2.0.0"`) to ensure that only patch updates are automatically applied. Regularly review and manually update dependencies to incorporate security fixes and new features. | LLM | SKILL.md:208 | |
| INFO | Unpinned or Loosely Pinned Dependencies The skill specifies dependencies using caret (`^`) ranges, such as `viem: "^2.0.0"` and `@bgd-labs/aave-address-book: "^4.0.0"`. While common, this practice allows for automatic updates to new minor or patch versions. If a new version introduces a vulnerability or breaking change, it could impact the skill's security or functionality without explicit review. Exact pinning (`"2.0.0"`) or tilde (`~`) ranges are generally recommended for production environments to ensure deterministic builds and reduce supply chain risks. Consider pinning dependencies to exact versions (e.g., `"@bgd-labs/aave-address-book": "4.x.y"`) or using tilde ranges (e.g., `"~4.0.0"`) to ensure that only patch updates are automatically applied. Regularly review and manually update dependencies to incorporate security fixes and new features. | LLM | SKILL.md:214 |
Scan History
Embed Code
[](https://skillshield.io/report/ba9b5fcd878ead8f)
Powered by SkillShield