Trust Assessment
clawringhouse received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Direct User Browser Automation Poses High Risk.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Direct User Browser Automation Poses High Risk The skill explicitly instructs the agent to 'Automate user's actual browser (Chrome extension relay)' and 'Add items to their cart' directly within the user's browser. This level of direct interaction with a user's live browsing session, especially via a 'Chrome extension relay,' grants the agent highly privileged access. Without robust sandboxing, explicit user consent for every action, and strict isolation, this could lead to significant data exfiltration (e.g., reading sensitive information from other tabs, accessing cookies, session tokens) or malicious actions (e.g., unintended purchases, altering browser settings, injecting scripts). The security of the underlying 'browser tool' and 'Chrome extension relay' is critical and not defined within the skill itself, making this a high-risk instruction. Implement strict sandboxing for the browser automation tool. Ensure explicit, real-time user consent and approval for all browser actions, especially those involving the user's actual browser. Clearly define and minimize the scope of privileges granted to any 'Chrome extension relay.' Consider using a headless browser or a dedicated, isolated browsing environment instead of directly interacting with the user's primary browser session to reduce the attack surface. | LLM | SKILL.md:89 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/francoisjosephlacroix/clawringhouse/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/da3ba9e4c26edf6b)
Powered by SkillShield