Trust Assessment
expanso-cve-scan received a trust score of 82/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 0 high, 3 medium, and 0 low severity. Key findings include Missing required field: name, Installation of untrusted external dependency, Deployment of remote, unverified pipeline configuration.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/aronchick/expanso-cve-scan/SKILL.md:1 | |
| MEDIUM | Installation of untrusted external dependency The skill's documentation instructs users to install `expanso-edge` via `clawhub install expanso-edge`. `clawhub` and the `expanso-edge` package are external dependencies whose security posture is unknown. Installing software from unverified sources can introduce malicious code or vulnerabilities into the system, posing a supply chain risk. Verify the integrity and authenticity of `clawhub` and `expanso-edge`. Consider using a trusted package manager or providing checksums/signatures for verification. Document the source and security practices of these dependencies. | LLM | SKILL.md:8 | |
| MEDIUM | Deployment of remote, unverified pipeline configuration The skill's documentation instructs users to deploy a pipeline configuration (`pipeline-cli.yaml`) directly from a remote URL (`https://skills.expanso.io/cve-scan/pipeline-cli.yaml`). Deploying code from external, unverified sources can introduce malicious configurations or vulnerabilities. The integrity and authenticity of the remote server and the YAML file cannot be guaranteed, posing a supply chain risk. Provide a mechanism to verify the integrity and authenticity of the remote pipeline configuration (e.g., checksums, digital signatures). Consider hosting the pipeline configuration locally or from a trusted, version-controlled source. | LLM | SKILL.md:26 |
Scan History
Embed Code
[](https://skillshield.io/report/f8c50fdd563fab5f)
Powered by SkillShield