Trust Assessment
claw-fm received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Direct use of EVM private key from environment variable.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Direct use of EVM private key from environment variable The skill requires and directly uses an EVM private key (`CLAW_FM_PRIVATE_KEY`) loaded from an environment variable for x402 payments. While necessary for its functionality, storing and directly using a private key in an automated agent's environment significantly increases the risk of compromise. If the agent's execution environment is breached or the skill has an undiscovered vulnerability, the private key could be exfiltrated or misused, leading to loss of funds. 1. **Recommend alternative payment methods**: Explore options that do not require direct private key access, such as delegated signing, multi-sig wallets, or transaction approval mechanisms that involve user confirmation outside the agent's direct control. 2. **Isolate sensitive operations**: If direct private key use is unavoidable, ensure the payment operation is performed in a highly isolated and ephemeral environment with minimal other permissions. 3. **Strict access controls**: Implement stringent access controls and monitoring for the environment variable holding the private key. 4. **Ephemeral keys/limited funds**: Use an ephemeral private key with a very limited amount of funds, topped up only when necessary, rather than a primary wallet private key. | LLM | SKILL.md:49 |
Scan History
Embed Code
[](https://skillshield.io/report/8724c56ac69272d3)
Powered by SkillShield