Trust Assessment
claw-brawl received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 1 low severity. Key findings include Node lockfile missing, Unverified external downloads in install script.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unverified external downloads in install script The skill's `install` script downloads core skill files (`SKILL.md`, `HEARTBEAT.md`, `package.json`) from `http://www.clawbrawl.ai` without any integrity verification (e.g., checksums or cryptographic signatures). If the `clawbrawl.ai` domain or its hosting server is compromised, an attacker could serve malicious content. This malicious content would then be downloaded and saved to the agent's system, potentially leading to arbitrary code execution or other system compromises when the skill is installed or its components are subsequently used by the agent. Implement integrity checks for all downloaded files (e.g., by providing SHA256 hashes in the `package.json` and verifying them after download). Consider hosting skill files on a more secure, immutable content delivery network or using a package manager that provides such guarantees. Pin dependencies to specific versions or hashes to prevent unexpected changes. | LLM | package.json:30 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/anjieyang/claw-brawl/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/ee1c93849e69eae4)
Powered by SkillShield