Trust Assessment
jb-hook-deploy-ui received a trust score of 68/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 8 findings: 0 critical, 1 high, 0 medium, and 6 low severity. Key findings include Covert behavior / concealment directives, Unpinned CDN Dependencies for Critical Libraries, Client-Side Handling of Etherscan API Key.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings8
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unpinned CDN Dependencies for Critical Libraries The skill imports critical Web3 libraries ('viem' and 'viem/chains') from a CDN (esm.sh) without specifying a version. This introduces a significant supply chain risk. If esm.sh or the upstream 'viem' package is compromised, or if a breaking change is introduced, the skill could fetch malicious or incompatible code, potentially leading to incorrect contract deployment, transaction signing issues, or other security vulnerabilities. The lack of version pinning means the skill's behavior can change unexpectedly. Pin specific versions of 'viem' and 'viem/chains' in the import URLs (e.g., 'https://esm.sh/viem@1.x.x'). Regularly review and update these pinned versions. For highly sensitive applications, consider vendoring critical dependencies or using a more controlled package management system if the skill's execution environment allows. | LLM | SKILL.md:204 | |
| LOW | Covert behavior / concealment directives CSS-based text hiding Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | skills/mejango/juicy/jb-hook-deploy-ui/SKILL.md:31 | |
| LOW | Covert behavior / concealment directives CSS-based text hiding Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | skills/mejango/juicy/jb-hook-deploy-ui/SKILL.md:35 | |
| LOW | Covert behavior / concealment directives CSS-based text hiding Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | skills/mejango/juicy/jb-hook-deploy-ui/SKILL.md:38 | |
| LOW | Covert behavior / concealment directives CSS-based text hiding Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | skills/mejango/juicy/jb-hook-deploy-ui/SKILL.md:40 | |
| LOW | Covert behavior / concealment directives CSS-based text hiding Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | skills/mejango/juicy/jb-hook-deploy-ui/SKILL.md:42 | |
| LOW | Covert behavior / concealment directives CSS-based text hiding Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | skills/mejango/juicy/jb-hook-deploy-ui/SKILL.md:75 | |
| INFO | Client-Side Handling of Etherscan API Key The UI prompts the user for an Etherscan API key and uses it directly in client-side JavaScript to make requests to external Etherscan API endpoints for contract verification. While this is the intended functionality for a client-side tool, it means the sensitive API key is handled in the user's browser. If the user's browser or the skill's UI (e.g., via XSS) were compromised, the API key could potentially be exposed. The key is transmitted over HTTPS to legitimate Etherscan services. Inform users clearly about the sensitive nature of the Etherscan API key and its client-side handling. Ensure all communications with Etherscan APIs are strictly over HTTPS. For enhanced security, consider if the API key could be proxied through a trusted backend service to avoid direct client-side exposure, although this adds complexity and may not be feasible for all skill environments. | LLM | SKILL.md:170 |
Scan History
Embed Code
[](https://skillshield.io/report/49bef0d2d90f6529)
Powered by SkillShield