Trust Assessment
clawchat-p2p received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Unpinned npm dependency version, Unverified upstream repository for skill installation.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unverified upstream repository for skill installation The skill's installation instructions require cloning the `https://github.com/alexrudloff/clawchat.git` repository and then performing a global `npm link`. This implicitly trusts the entire content of this external repository. A compromise of this upstream repository could lead to the installation of malicious code, which would then be globally executable via the `clawchat` command. Given the skill's P2P nature and use of `@stacks/wallet-sdk` (which handles blockchain transactions and potentially private keys), a compromised `clawchat` tool could lead to data exfiltration (e.g., private keys, sensitive messages) or command injection into the agent's environment. Implement a robust verification process for external repositories, such as cryptographic signing of releases, auditing the repository's code, or using a trusted package registry with strict content policies. For production environments, consider vendoring dependencies or using immutable build artifacts. Avoid global installations (`npm link`) for skills unless absolutely necessary and thoroughly vetted. | LLM | SKILL.md:24 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/alexrudloff/clawchat-p2p/SKILL.md:1 | |
| MEDIUM | Unpinned npm dependency version Dependency '@chainsafe/libp2p-noise' is not pinned to an exact version ('^16.0.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/alexrudloff/clawchat-p2p/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/d144f71779b54e9b)
Powered by SkillShield