Trust Assessment
instapaper received a trust score of 92/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Unpinned dependency in installation instructions, External Homebrew tap in installation instructions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned dependency in installation instructions The skill instructs users to install the `instapaper-cli` tool using `go install github.com/vburojevic/instapaper-cli/cmd/ip@latest`. Using `@latest` means the exact version is not pinned, which can lead to unexpected behavior, breaking changes, or the introduction of malicious code if the upstream repository is compromised. This introduces a supply chain risk for users following these instructions. Recommend pinning the version of the `instapaper-cli` tool in the installation instructions (e.g., `go install github.com/vburojevic/instapaper-cli/cmd/ip@vX.Y.Z`) to ensure deterministic and secure installations. | LLM | SKILL.md:13 | |
| LOW | External Homebrew tap in installation instructions The skill instructs users to install the `instapaper-cli` tool using `brew tap vburojevic/tap && brew install instapaper-cli`. Tapping external repositories introduces a supply chain risk, as the integrity of the tapped repository and its formulas is outside the control of official Homebrew. A compromised tap could lead to the installation of malicious software. Advise users to verify the authenticity and integrity of external taps before adding them. For skill developers, consider providing alternative installation methods that rely on more trusted or verifiable sources, or explicitly state the risks associated with external taps. | LLM | SKILL.md:14 |
Scan History
Embed Code
[](https://skillshield.io/report/2257f0cc48fc5f2f)
Powered by SkillShield