Trust Assessment
clawpay received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 1 low severity. Key findings include Node lockfile missing, Unverified external content and version mismatch during installation.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unverified external content and version mismatch during installation The skill's installation instructions direct the user to download skill components (SKILL.md, HEARTBEAT.md, package.json) from an external URL (`https://clawpay.ai`) using `curl`. These files are fetched without any integrity verification (e.g., checksums, cryptographic signatures). A compromise of the `clawpay.ai` domain or its hosting infrastructure could lead to the injection of malicious code into the skill's local installation, posing a significant supply chain risk.
Furthermore, the `package.json` file downloaded during installation (`version: 1.0.0`) differs in content and version from the skill's manifest (`version: 1.0.1`). This version mismatch and reliance on an unverified external source for core skill files introduces instability and potential security vulnerabilities if the older version has known issues or different security configurations. Bundle all skill files directly within the skill package to eliminate external dependencies at install time. If external fetching is unavoidable, implement cryptographic verification (e.g., SHA256 hashes, GPG signatures) for all fetched components. Ensure that the versions and content of locally installed files match the skill's manifest and are consistently updated. | LLM | SKILL.md:24 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/kirch/clawpay/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/e65f5880a651f5be)
Powered by SkillShield