Trust Assessment
fizzy-cli received a trust score of 91/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Unpinned npm dependency version, Weak Local Encryption for API Token.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned npm dependency version Dependency 'chalk' is not pinned to an exact version ('^5.3.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/emredoganer/emredoganer-fizzy-cli/package.json | |
| LOW | Weak Local Encryption for API Token The Personal Access Token is stored encrypted on the local filesystem using a key derived from machine-specific identifiers (hostname and username). While this prevents casual viewing of the token in plain text, a local attacker with code execution privileges on the same machine can easily re-derive the encryption key and decrypt the stored token. This provides limited protection against a compromised local environment, as the key is deterministically generated and not protected by a user-provided passphrase or system-level secure storage. For stronger protection against local attackers, consider using platform-specific secure storage mechanisms (e.g., macOS Keychain, Windows Credential Manager) or prompting the user for a master password to encrypt the token. If these are not feasible, clearly document this limitation to users. | LLM | src/lib/config.ts:19 |
Scan History
Embed Code
[](https://skillshield.io/report/06d29bd89dff29bd)
Powered by SkillShield