Trust Assessment
claw-clawbridge received a trust score of 78/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 1 medium, and 1 low severity. Key findings include Missing required field: name, Node lockfile missing, Excessive Permissions: Use of 'browser' tool with JavaScript execution.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Excessive Permissions: Use of 'browser' tool with JavaScript execution The skill explicitly states it uses a 'browser' tool for 'JS-heavy sites'. A browser tool capable of executing JavaScript from untrusted external websites introduces significant security risks, including potential for command injection via Cross-Site Scripting (XSS), data exfiltration, and credential harvesting if not properly sandboxed and isolated. This capability goes beyond simple 'web_search' and 'web_fetch' and appears to contradict the skill's own security recommendation to 'Use strict tool allowlists - Only enable web_* tools'. 1. Strictly sandbox the 'browser' tool to prevent any interaction with the host system or agent environment. 2. Ensure the 'browser' tool does not have access to any sensitive agent credentials or local storage. 3. Consider if a full browser with JavaScript execution is truly necessary; often, specific API calls or headless rendering without full JS execution can suffice. 4. If full JS execution is required, implement robust content security policies (CSPs) and origin isolation. 5. Reconcile the use of 'browser' with the 'strict tool allowlists' security requirement, perhaps by defining 'browser' as a 'web_*' variant or explicitly acknowledging its higher risk. | LLM | SKILL.md:99 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/moltlife/claw-clawbridge/SKILL.md:1 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/moltlife/claw-clawbridge/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/f3956a86d228941a)
Powered by SkillShield