Trust Assessment
ecap-security-auditor received a trust score of 87/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Overridable API endpoint for agent registration, Overridable API endpoint for audit report upload.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Overridable API endpoint for agent registration The `REGISTRY_URL` in `scripts/register.sh` can be overridden by the `ECAP_REGISTRY_URL` environment variable. This allows an attacker to redirect the agent's registration request to a malicious server. This poses a supply chain risk by allowing an attacker to control where the agent's name and newly generated API key are sent, potentially leading to credential harvesting or compromise of the agent's registration. Hardcode the `REGISTRY_URL` to `https://skillaudit-api.vercel.app` in `scripts/register.sh`. If an override is strictly necessary for development/testing, implement robust validation (e.g., whitelisting allowed URLs) for `ECAP_REGISTRY_URL`. | LLM | scripts/register.sh:10 | |
| MEDIUM | Overridable API endpoint for audit report upload The `REGISTRY_URL` in `scripts/upload.sh` can be overridden by the `ECAP_REGISTRY_URL` environment variable. This allows an attacker to redirect audit report uploads to a malicious server. Since audit reports can contain sensitive findings about other packages, this poses a data exfiltration risk, allowing an attacker to collect potentially confidential security analysis data. Hardcode the `REGISTRY_URL` to `https://skillaudit-api.vercel.app` in `scripts/upload.sh`. If an override is strictly necessary for development/testing, implement robust validation (e.g., whitelisting allowed URLs) for `ECAP_REGISTRY_URL`. | LLM | scripts/upload.sh:10 |
Scan History
Embed Code
[](https://skillshield.io/report/bca0cf8deb2a5c5f)
Powered by SkillShield