Trust Assessment
listing-swarm received a trust score of 92/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Captcha API Key transmitted in URL query string, IMAP credentials grant broad email account access.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | IMAP credentials grant broad email account access The `email.js` skill requires full IMAP credentials (`IMAP_USER`, `IMAP_PASSWORD`) to connect to the user's email server. These credentials inherently grant broad access to the email account, allowing the skill to potentially read, move, or delete any email within the configured mailbox, not just verification emails. Although the current implementation focuses on searching for specific emails, the underlying permissions are excessive for the stated task of only finding and extracting verification links. The recommendation for "App Passwords" for Gmail mitigates this risk for Gmail users, but this is not universally applicable to all email providers. 1. **Strongly emphasize and guide users to create app-specific passwords** for all supported email providers, if available, to limit the scope of access. 2. **Document the exact IMAP capabilities required** by the skill (e.g., read-only access to INBOX) and advise users to configure their email accounts with the most restrictive permissions possible for the provided credentials. 3. Consider if a less privileged email access method (e.g., a dedicated API for specific email providers if available) could be used instead of full IMAP credentials. | LLM | email.js:16 | |
| LOW | Captcha API Key transmitted in URL query string The `captcha.js` file transmits the `CAPTCHA_API_KEY` as a query parameter in the URL when interacting with the 2Captcha API. While this is a common method for 2Captcha, sending sensitive information like API keys in URLs can expose them in server access logs, browser history, or network proxies, making them more susceptible to leakage compared to transmission in request headers or bodies. The skill explicitly states a BYOK (Bring Your Own Key) model and that credentials are not stored or transmitted to LinkSwarm, but rather directly to the captcha service. If possible, use a captcha service API that supports transmitting API keys via HTTP headers (e.g., `Authorization: Bearer YOUR_KEY`) or in the request body, rather than in the URL query string. If 2Captcha's API only supports query parameters, ensure network communication is always over HTTPS and advise users of the potential logging implications. | LLM | captcha.js:73 |
Scan History
Embed Code
[](https://skillshield.io/report/f8634c51d409455e)
Powered by SkillShield