Trust Assessment
crypto-simulator received a trust score of 77/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 5 findings: 0 critical, 0 high, 3 medium, and 2 low severity. Key findings include Missing required field: name, Unpinned npm dependency version, Node lockfile missing.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/sa9saq/crypto-simulator/SKILL.md:1 | |
| MEDIUM | Unpinned npm dependency version Dependency 'better-sqlite3' is not pinned to an exact version ('^11.8.1'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/sa9saq/crypto-simulator/package.json | |
| MEDIUM | Arbitrary Database Path via Environment Variable The skill allows the database file path to be specified via the `SIMULATOR_DB_PATH` environment variable. If an attacker can control this environment variable, they could direct the skill to create or overwrite a SQLite database file in an arbitrary location on the filesystem where the process has write permissions. This could lead to data tampering, denial of service by overwriting critical system files (if the process has elevated privileges), or unintended file creation. Restrict the `SIMULATOR_DB_PATH` environment variable to a predefined, secure directory or validate its value to ensure it falls within an allowed set of paths. Alternatively, remove the ability to specify an arbitrary path and hardcode the database location to a secure, skill-specific data directory. | LLM | src/db.ts:5 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/sa9saq/crypto-simulator/package.json | |
| LOW | Information Disclosure via Generic Error Messages The API's generic error handler returns `error.message` directly to the client for all 400-level errors. While convenient for debugging, this can inadvertently expose internal error details, stack traces, or sensitive system information if an unhandled exception occurs. Such information could be used by an attacker to gain a better understanding of the system's architecture or identify potential vulnerabilities. Implement more specific error handling for different types of errors. For production environments, return generic error messages (e.g., 'An unexpected error occurred') to clients and log detailed error information internally. Avoid exposing raw error messages or stack traces directly to external users. | LLM | src/server.ts:184 |
Scan History
Embed Code
[](https://skillshield.io/report/0c30ce0cb8ab0990)
Powered by SkillShield