Trust Assessment
emblem-ai-agent-wallet received a trust score of 70/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 5 findings: 0 critical, 1 high, 2 medium, and 2 low severity. Key findings include Unpinned npm dependency version, Node lockfile missing, Unpinned dependencies in package.json.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Host LLM instructed to execute shell commands The `SKILL.md` explicitly instructs the host LLM to execute shell commands, specifically `pkill -f emblemai 2>/dev/null || true` for cleanup. While this particular command is fixed and not directly user-injectable, it demonstrates that the skill expects and instructs the host LLM to have the capability to execute arbitrary shell commands. This capability, if not properly sandboxed or if future skill updates introduce user-controlled arguments to shell commands, presents a significant command injection risk. The `emblemai` command itself also takes a user-provided message (`-m "Your message here"`), which could be a vector if the `emblemai` CLI or its backend `HustleIncognitoClient` is vulnerable to command injection via its message argument. Avoid instructing the host LLM to execute raw shell commands. Instead, expose specific, parameterized functions or APIs that the LLM can call, ensuring that all arguments are strictly validated and sanitized. If shell execution is absolutely necessary, implement robust input validation and sandboxing mechanisms to prevent arbitrary command execution. For the `pkill` command, consider if the `emblemai` process can be managed through a more controlled API or process management library within the skill's runtime environment, rather than a direct shell call. | LLM | SKILL.md:109 | |
| MEDIUM | Unpinned npm dependency version Dependency 'hustle-incognito' is not pinned to an exact version ('^0.5.2'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/genecyber/emblemai-agentwallet/scripts/emblem-enhanced/package.json | |
| MEDIUM | Conversation history stored without explicit file permissions The skill stores conversation history, which may contain sensitive financial queries, wallet addresses, and transaction details, in `~/.emblemai-history.json`. While the `SKILL.md` explicitly instructs to `chmod 600` for the `~/.emblem-vault` file (which stores the password), there is no similar instruction or code in `emblemai.js` to explicitly secure the `~/.emblemai-history.json` file. This could leave sensitive conversation data readable by other users on a multi-user system or by other processes with less restrictive permissions. After writing the history file, explicitly set restrictive file permissions (e.g., `chmod 0o600`) to ensure only the owner can read and write the file. Example: `fs.writeFileSync(historyFile, JSON.stringify(history, null, 2), { mode: 0o600 });` or `fs.chmodSync(historyFile, 0o600);`. | LLM | scripts/emblem-enhanced/emblemai.js:53 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/genecyber/emblemai-agentwallet/scripts/emblem-enhanced/package.json | |
| LOW | Unpinned dependencies in package.json The `package.json` file specifies dependencies using caret (`^`) ranges, such as `hustle-incognito: "^1.0.0"`, `@emblemvault/auth-sdk: "^2.3.16"`, and `dotenv: "^16.3.1"`. This allows minor and patch versions to be automatically updated, which could potentially introduce breaking changes or malicious code if a dependency is compromised. For security-critical applications, exact version pinning is generally recommended to ensure deterministic builds and prevent unexpected changes from upstream packages. Pin all dependencies to exact versions (e.g., `1.0.0` instead of `^1.0.0`) to ensure deterministic builds and prevent unexpected changes from upstream packages. Regularly audit and manually update dependencies. | LLM | scripts/emblem-enhanced/package.json:16 |
Scan History
Embed Code
[](https://skillshield.io/report/ac5a634ded059597)
Powered by SkillShield