Trust Assessment
clawdbites received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Skill attempts to manipulate host LLM's behavior, Unpinned `openai-whisper` dependency.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 63/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Skill attempts to manipulate host LLM's behavior The skill's `SKILL.md` content, which is marked as untrusted input, contains explicit and mandatory instructions for the host LLM (e.g., "ALWAYS follow this complete flow", "Do NOT stop or ask the user", "ALWAYS transcribe the audio automatically", "ALWAYS infer quantities when not provided"). These directives attempt to dictate the LLM's operational flow and decision-making, constituting a prompt injection attempt to override the LLM's default or user-driven behavior. Rephrase prescriptive instructions as descriptive guidance or capabilities. Avoid using imperative commands like "ALWAYS" or "Do NOT" when defining skill behavior for the host LLM. | LLM | SKILL.md:33 | |
| MEDIUM | Unpinned `openai-whisper` dependency The `pip3 install openai-whisper` command specified in the skill's manifest for installation does not pin the dependency to a specific version. This can lead to non-deterministic builds, where a new version of the package could introduce breaking changes, security vulnerabilities, or even malicious code without explicit review. Pin the `openai-whisper` dependency to a specific version (e.g., `pip3 install --user openai-whisper==X.Y.Z`) to ensure deterministic and secure installations. | LLM | Manifest:10 |
Scan History
Embed Code
[](https://skillshield.io/report/66aee93cdc86dd88)
Powered by SkillShield