Trust Assessment
fear-greed received a trust score of 90/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include External Third-Party Content Embeds, Reliance on External API Endpoint.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | External Third-Party Content Embeds The `SKILL.md` documentation suggests embedding content from external third-party domains (`cdn.strykr.com` and `widgets.strykr.com`) via `<script>` and `<iframe>` tags. If these external domains are compromised, they could serve malicious JavaScript or content, leading to Cross-Site Scripting (XSS) or other client-side attacks if the skill's output is rendered in a web context, or potentially data exfiltration if the agent processes the HTML. Advise users to exercise caution when embedding third-party content. For scripts, consider using Subresource Integrity (SRI) if the CDN supports it, or self-hosting critical scripts. For iframes, ensure strict Content Security Policy (CSP) and consider using the `sandbox` attribute to restrict capabilities. | LLM | SKILL.md:100 | |
| MEDIUM | Reliance on External API Endpoint The skill relies on an external API endpoint (`https://strykr-prism.up.railway.app`) for its core functionality, as defined in `scripts/fear-greed.sh` and `skill.json`. While this is a common pattern, the security and reliability of this third-party service are outside the control of the skill developer. A compromise or malicious change to this API could lead to incorrect data, service disruption, or potentially unexpected behavior if the API response format changes in an exploitable way. Recommend monitoring the upstream service for availability and security. Implement robust error handling and validation for API responses to mitigate issues from unexpected data formats or service outages. Consider providing options for users to configure alternative, trusted data sources if available. | LLM | scripts/fear-greed.sh:4 |
Scan History
Embed Code
[](https://skillshield.io/report/67c15e5090fc5b99)
Powered by SkillShield