Trust Assessment
clawchain received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unsanitized input used in HEREDOC for configuration file.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsanitized input used in HEREDOC for configuration file The `init-clawchain.sh` script uses the user-provided `RPC_URL` argument directly within an unquoted HEREDOC block. This allows for command injection if the `RPC_URL` contains shell metacharacters (e.g., `$(command)`). An attacker could execute arbitrary commands on the system where the script is run by crafting a malicious `RPC_URL` argument. Quote the HEREDOC delimiter (e.g., `<< 'HEREDOC'`) to prevent variable expansion and command substitution within the HEREDOC content. Alternatively, sanitize the `RPC_URL` input before using it, for example, by escaping shell metacharacters or validating its format. | LLM | scripts/init-clawchain.sh:9 |
Scan History
Embed Code
[](https://skillshield.io/report/d6d0c87f0cf25287)
Powered by SkillShield