Trust Assessment
helpscout received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Unpinned npm dependency version, Outdated and unmaintained `node-fetch` dependency, Highly suspicious `undici` dependency version.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Highly suspicious `undici` dependency version The `package.json` and `package-lock.json` specify `undici` version `^7.20.0`. As of early 2024, stable `undici` versions are typically in the `5.x` or `6.x` range. A version number like `7.20.0` is highly unusual and could indicate a typosquatting attempt, a misconfigured dependency, or a future version that does not yet exist. This poses a significant supply chain risk as it could lead to installing malicious or non-existent packages. Verify the correct version of `undici` intended for use. If `7.20.0` is a mistake, correct it to a known, stable, and legitimate version (e.g., `^6.0.0`). If it's a typosquat, remove the malicious dependency immediately. | LLM | package.json:14 | |
| MEDIUM | Unpinned npm dependency version Dependency 'node-fetch' is not pinned to an exact version ('^2.6.8'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/fabiensebban/helpscout/package.json | |
| MEDIUM | Outdated and unmaintained `node-fetch` dependency The `package.json` and `package-lock.json` specify `node-fetch` version `^2.6.8`. `node-fetch` v2.x is no longer actively maintained, with the last release being `2.6.9`. Using unmaintained software can expose the skill to known vulnerabilities that will not be patched. It is recommended to upgrade to `node-fetch` v3.x or later, or use the built-in `fetch` API in Node.js 18+. Upgrade `node-fetch` to a currently maintained version (e.g., `^3.0.0`) or migrate to Node.js's native `fetch` API if the runtime environment supports it. | LLM | package.json:13 |
Scan History
Embed Code
[](https://skillshield.io/report/d5cecffb8de9d5d3)
Powered by SkillShield