Trust Assessment
clawdsense received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 6 findings: 2 critical, 1 high, 3 medium, and 0 low severity. Key findings include Arbitrary command execution, Potential hardcoded secret (high entropy), Sensitive path access: AI agent config.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 63/100, indicating areas for improvement.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings6
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary command execution Node.js child_process require Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/snail3d/clawd/clawdsense-skill/scripts/health-monitor.js:10 | |
| CRITICAL | Hardcoded API Key The `analyzer.js` script contains a hardcoded Groq API key (`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`) as a fallback if the `GROQ_API_KEY` environment variable is not set. This practice exposes a sensitive credential directly in the codebase, making it vulnerable to compromise if the repository is accessed or if the skill is deployed without proper environment variable configuration. The same key is also present in the `SKILL.md` documentation as an example, increasing the likelihood of its accidental use in production. Remove the hardcoded default API key. The script should explicitly require the `GROQ_API_KEY` environment variable to be set, or fail gracefully if it's missing, rather than using a default. Update documentation to reflect this requirement and avoid providing example keys that could be copied directly. | LLM | scripts/analyzer.js:9 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.clawdbot/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | skills/snail3d/clawd/clawdsense-skill/SKILL.md:34 | |
| MEDIUM | Potential hardcoded secret (high entropy) A high-entropy string (entropy=4.99) was found in a credential-like context. Verify this is not a hardcoded secret. Use environment variables for sensitive values. | Static | skills/snail3d/clawd/clawdsense-skill/SKILL.md:71 | |
| MEDIUM | Potential hardcoded secret (high entropy) A high-entropy string (entropy=4.99) was found in a credential-like context. Verify this is not a hardcoded secret. Use environment variables for sensitive values. | Static | skills/snail3d/clawd/clawdsense-skill/SKILL.md:75 | |
| MEDIUM | Missing Dependency Management File (package.json) The `media-receiver.js` script imports external Node.js libraries (`express`, `multer`, `uuid`). However, a `package.json` file, which is standard for Node.js projects to manage dependencies, is not provided. Without this file, it's impossible to verify if these dependencies are pinned to specific, known-good versions, if they are legitimate packages (e.g., guarding against typosquatting), or to easily check for known vulnerabilities. This lack of explicit dependency management introduces a significant supply chain risk. Create a `package.json` file that explicitly lists and pins the versions of all external dependencies (`express`, `multer`, `uuid`). Use a package manager (e.g., npm or yarn) to install and manage these dependencies, and regularly audit them for known vulnerabilities. | LLM | scripts/media-receiver.js:7 |
Scan History
Embed Code
[](https://skillshield.io/report/c8f590c1b2d8ad61)
Powered by SkillShield