Trust Assessment
claw-admin received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Skill returns sensitive credentials (temporary password, OAuth URL).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Skill returns sensitive credentials (temporary password, OAuth URL) The `Create Email Account` API endpoint, as documented, returns a temporary password and an OAuth `connect_url`. These are highly sensitive credentials for the newly created Google Workspace account. While providing these credentials is the intended function of the skill, the LLM's handling of this output could lead to data exfiltration if not managed securely. Potential risks include logging the password, displaying it in insecure chat interfaces, or storing it persistently. The skill documentation itself warns, 'Save the password immediately — it is shown only once,' highlighting its sensitivity. Implement robust credential handling within the LLM agent. This includes: 1. **Ephemeral Storage:** Do not log or persistently store the temporary password or `connect_url`. 2. **Secure Communication:** Ensure these credentials are only communicated to the end-user via secure, private channels. 3. **Redaction:** Redact sensitive information from any logs or publicly visible outputs. 4. **User Guidance:** Explicitly instruct the user to save the password securely and to complete the OAuth connection process promptly. 5. **Confirmation:** Require user confirmation before displaying or using sensitive credentials. | LLM | SKILL.md:30 |
Scan History
Embed Code
[](https://skillshield.io/report/4589860f514dc874)
Powered by SkillShield