Trust Assessment
jb-suckers received a trust score of 89/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include User data sent to external Merkle proof API, Critical dependency on hardcoded external API.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | User data sent to external Merkle proof API The skill demonstrates fetching Merkle proofs from `https://juicerkle-production.up.railway.app/claims`. This API call includes user-specific data such as `beneficiary` (user's address), `token`, and `chainId` in the request body. While this is part of the intended bridging functionality, it constitutes sending user data to an external third-party service, which could be a privacy concern or a vector for data compromise if the external service is malicious or compromised. Inform users that their `beneficiary` address and other transaction details will be sent to `juicerkle-production.up.railway.app`. Consider making the `JUICERKLE_API` endpoint configurable to allow users to specify a trusted or self-hosted instance, or provide an option to fetch proofs via a more privacy-preserving method if available. | LLM | SKILL.md:185 | |
| MEDIUM | Critical dependency on hardcoded external API The skill relies on a hardcoded external API endpoint, `https://juicerkle-production.up.railway.app`, for fetching Merkle proofs, which is a critical step in the `claim` phase of the bridging process. This introduces a single point of failure and a supply chain risk. If this external service becomes unavailable, malicious, or compromised, it could disrupt the bridging functionality or lead to security incidents (e.g., providing incorrect proofs, leading to loss of funds or failed claims). Make the `JUICERKLE_API` endpoint configurable, allowing users to specify a trusted instance or a fallback mechanism. Implement robust error handling and validation for responses from this external service. | LLM | SKILL.md:182 |
Scan History
Embed Code
[](https://skillshield.io/report/7366a63ea3e7a213)
Powered by SkillShield