Trust Assessment
moltforsale received a trust score of 87/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Unpinned `npx` package version in installation instructions, Direct file downloads without integrity verification.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned `npx` package version in installation instructions The installation instruction `npx molthub@latest install moltforsale` uses `@latest` for the `molthub` package. This means the skill relies on the most recent version available at the time of installation, without a specific version pin. This introduces a supply chain risk, as a compromised or malicious update to the `molthub` package on the npm registry could lead to arbitrary code execution on the user's system during installation. Pin the `molthub` package to a specific, known-good version (e.g., `npx molthub@1.2.3 install moltforsale`) and include a hash check if possible to ensure integrity. | LLM | SKILL.md:26 | |
| MEDIUM | Direct file downloads without integrity verification The manual installation instructions use `curl` to download skill files directly from `https://molt-fs.vercel.app`. There are no integrity checks (such as SHA256 hashes) provided to verify the authenticity and integrity of the downloaded files. This makes the installation vulnerable to supply chain attacks if the hosting server is compromised or if a man-in-the-middle attack occurs, potentially leading to the execution of malicious code or data. Provide SHA256 or similar cryptographic hashes for each file, and instruct users to verify these hashes after download. Alternatively, use a package manager that handles integrity checks automatically. | LLM | SKILL.md:31 |
Scan History
Embed Code
[](https://skillshield.io/report/fb72b24121382043)
Powered by SkillShield