Trust Assessment
fulcra-context received a trust score of 81/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 0 high, 3 medium, and 0 low severity. Key findings include Suspicious import: http.client, Unpinned 'uvx' package dependency in MCP server configuration, Unpinned 'npx' package dependency in MCP server configuration.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Suspicious import: http.client Import of 'http.client' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/arc-claw-bot/fulcra-context/scripts/fulcra_auth.py:20 | |
| MEDIUM | Unpinned 'uvx' package dependency in MCP server configuration The skill's 'mcpServers' configuration for 'fulcra_context' uses 'uvx' to execute 'fulcra-context-mcp@latest'. Using '@latest' means the package version is not pinned, which introduces a supply chain risk. A malicious update to the 'fulcra-context-mcp' package could be automatically downloaded and executed by the host system without prior review, potentially leading to compromise. Pin the 'fulcra-context-mcp' package to a specific, known-good version (e.g., 'fulcra-context-mcp@1.2.3') in the 'args' array to ensure deterministic execution and mitigate risks from unexpected or malicious updates. | LLM | SKILL.md:47 | |
| MEDIUM | Unpinned 'npx' package dependency in MCP server configuration The skill's 'mcpServers' configuration for 'fulcra_context' uses 'npx' to execute 'mcp-remote'. 'npx' typically downloads and runs the latest version of a package if not explicitly specified or locally installed. This behavior introduces a supply chain risk, as a malicious update to the 'mcp-remote' package could be automatically executed by the host system without prior review, potentially leading to compromise. Pin the 'mcp-remote' package to a specific, known-good version (e.g., 'npx mcp-remote@1.0.0') in the 'args' array or ensure it is installed globally with a pinned version before execution to ensure deterministic behavior and mitigate risks from unexpected or malicious updates. | LLM | SKILL.md:40 |
Scan History
Embed Code
[](https://skillshield.io/report/6872ba0810eb20e5)
Powered by SkillShield