Security Audit

MockAPI - Instant REST API from JSON

github.com/openclaw/skills

AI SkillCommit 13146e6a3d46

TRUSTED

Scanned 2 months ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

MockAPI - Instant REST API from JSON received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unpinned npm dependency.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

100%

Dependency Graph

100%

LLM Behavioral Safety

85%

Behavioral Risk Signals

Shell Execution

1 finding

Security Findings1

Severity	Finding	Layer	Location
HIGH	Unpinned npm dependency The skill recommends installing an npm package (`@lxgicstudios/mockapi`) without specifying a version. This makes the installation vulnerable to supply chain attacks, where a malicious update to the package could lead to arbitrary code execution on the user's system when the package is installed or updated. Pin the dependency to a specific version (e.g., `npm install -g @lxgicstudios/mockapi@1.2.3`) to ensure consistent and secure installations. Regularly audit and update pinned versions.	LLM	SKILL.md:10

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/f0527a6f7c5f0fef.svg)](https://skillshield.io/report/f0527a6f7c5f0fef)