Trust Assessment
keep-protocol received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include Agent can auto-start server process, Unpinned dependencies and Docker image tag.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Agent can auto-start server process The `keep_ensure_server()` tool allows the agent to automatically start a server process if it's not already running. This grants the agent significant control over the execution environment, including resource allocation and potentially binding to network ports. An attacker could instruct a compromised agent to repeatedly start services, leading to resource exhaustion (Denial of Service) or expose unintended services to the network. Restrict the agent's ability to call `keep_ensure_server()` or ensure that any server started by this tool operates within a tightly controlled sandbox with minimal privileges and resource limits. Clearly document the security implications of this tool. | LLM | SKILL.md:20 | |
| HIGH | Unpinned dependencies and Docker image tag The skill's installation instructions recommend installing Python packages without specific version pinning (e.g., `pip install keep-protocol` on lines 39 and 52) and using the `:latest` tag for the Docker server image (`ghcr.io/clcrawford-dev/keep-server:latest` on line 49). This practice introduces significant supply chain risk, as it allows for the automatic download of potentially unverified, vulnerable, or malicious code if the upstream repositories are compromised or updated with breaking changes. It also increases the risk of unexpected behavior due to non-backward compatible updates. Pin all Python package dependencies to specific, known-good versions (e.g., `keep-protocol==1.2.3`). For Docker images, use immutable tags (e.g., `keep-server:1.2.3`) or, ideally, specific content digests instead of `:latest`. | LLM | SKILL.md:39 |
Scan History
Embed Code
[](https://skillshield.io/report/194a2155ec59b23b)
Powered by SkillShield