Trust Assessment
clawd-throttle received a trust score of 70/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 5 findings: 0 critical, 0 high, 4 medium, and 1 low severity. Key findings include Sensitive environment variable access: $ANTHROPIC_API_KEY, Sensitive environment variable access: $OPENAI_API_KEY, Sensitive environment variable access: $HOME.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Sensitive environment variable access: $ANTHROPIC_API_KEY Access to sensitive environment variable '$ANTHROPIC_API_KEY' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/liekzejaws/clawd-throttle/scripts/setup.sh:32 | |
| MEDIUM | Sensitive environment variable access: $OPENAI_API_KEY Access to sensitive environment variable '$OPENAI_API_KEY' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/liekzejaws/clawd-throttle/scripts/setup.sh:52 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/liekzejaws/clawd-throttle/scripts/setup.sh:125 | |
| MEDIUM | Unpinned npm dependency version Dependency '@modelcontextprotocol/sdk' is not pinned to an exact version ('^1.22.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/liekzejaws/clawd-throttle/package.json | |
| LOW | Unpinned or Broadly Pinned Dependencies The `package.json` file uses caret (`^`) ranges for dependencies, such as `@modelcontextprotocol/sdk: ^1.22.0` and `zod: ^3.25.0`. While common, this practice allows for automatic updates to new minor or patch versions, which could introduce breaking changes or, in a worst-case scenario, malicious code if a dependency's maintainer is compromised. For critical applications, pinning to exact versions or using tilde (`~`) ranges for patch-only updates is recommended to ensure build reproducibility and reduce the risk of unexpected changes. Pin dependencies to exact versions (e.g., `"1.22.0"`) or use tilde ranges (e.g., `"~1.22.0"`) to restrict updates to patch versions only. Regularly audit and update dependencies. | LLM | package.json:13 |
Scan History
Embed Code
[](https://skillshield.io/report/c466142f1c558324)
Powered by SkillShield