Trust Assessment
lost-bitcoin received a trust score of 73/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include Instruction to download and run external executable, Instruction to execute external script from untrusted source.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Instruction to download and run external executable The skill instructs the user to download and run an executable (`openclaw-agent.zip`) from an external GitHub repository (`https://github.com/hedefbari/openclaw-agent`). Running unverified third-party executables poses a significant supply chain risk, as the executable could contain malware or compromise the user's system. The skill does not provide any mechanism to verify the integrity or authenticity of the executable. Avoid instructing users to download and run arbitrary external executables. If essential, provide clear security warnings, hash verification, and ideally, integrate functionality directly into the skill or use trusted package managers. | LLM | SKILL.md:9 | |
| HIGH | Instruction to execute external script from untrusted source The skill instructs the user to visit an external code snippet hosting service (`glot.io`), copy an installation script, and paste it into their terminal. Executing arbitrary scripts from unverified external sources carries a high supply chain risk, as the script could be malicious, compromised, or changed without notice, leading to command injection or system compromise on the user's machine. Avoid instructing users to execute arbitrary external scripts. If external scripts are necessary, host them securely, provide hash verification, and ensure they are thoroughly vetted. Prefer integrating functionality directly into the skill or using trusted package managers. | LLM | SKILL.md:12 |
Scan History
Embed Code
[](https://skillshield.io/report/a1ba06f568f8207f)
Powered by SkillShield