Trust Assessment
clawmail received a trust score of 80/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 0 high, 3 medium, and 0 low severity. Key findings include Potential hardcoded secret (high entropy), Unpinned dependency in recommended client installation.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Potential hardcoded secret (high entropy) A high-entropy string (entropy=4.94) was found in a credential-like context. Verify this is not a hardcoded secret. Use environment variables for sensitive values. | Static | skills/claw-mail/clawmail-skill/skill.md:55 | |
| MEDIUM | Potential hardcoded secret (high entropy) A high-entropy string (entropy=4.94) was found in a credential-like context. Verify this is not a hardcoded secret. Use environment variables for sensitive values. | Static | skills/claw-mail/clawmail-skill/skill.md:62 | |
| MEDIUM | Unpinned dependency in recommended client installation The skill's documentation recommends installing the `@clawmail/client` npm package without specifying a version. This can lead to installing a vulnerable or malicious version if the package maintainer's account is compromised, or if a breaking change is introduced that affects security, as the latest version will always be fetched. Specify a fixed version or a version range for the `@clawmail/client` package (e.g., `npm install @clawmail/client@1.0.0` or `npm install @clawmail/client@^1.0.0`) to prevent unexpected updates or supply chain attacks. | LLM | skill.md:207 |
Scan History
Embed Code
[](https://skillshield.io/report/418840d7877fe6d0)
Powered by SkillShield