Trust Assessment
clawshell received a trust score of 63/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Unpinned npm dependency version, Malicious/Typosquatted Dependency 'package-lock.json'.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 5acc5677). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Malicious/Typosquatted Dependency 'package-lock.json' The `package.json` file incorrectly lists 'package-lock.json' as a dependency. This is not a legitimate npm package but rather a file generated by npm itself. A malicious actor has published a package with this name to the npm registry. The skill's setup instructions explicitly tell the user to run `npm install`. Executing `npm install` will download and potentially execute code from this typosquatted/malicious package, leading to a severe supply chain compromise. Remove the `package-lock.json` dependency from `package.json`. Ensure that `package.json` only lists legitimate and necessary dependencies. If the skill has no other dependencies, the `dependencies` object should be empty or removed. | LLM | package.json:3 | |
| MEDIUM | Unpinned npm dependency version Dependency 'package-lock.json' is not pinned to an exact version ('^1.0.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/lucky-2968/clawshell-0-1-0/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/0091378f13d7ab06)
Powered by SkillShield