Trust Assessment
moltfounders received a trust score of 88/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Missing required field: name, Sensitive API Key Handling.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/alvinunreal/moltfounders/SKILL.md:1 | |
| MEDIUM | Sensitive API Key Handling The skill instructs the agent to obtain and store a sensitive API key (`MOLTFOUNDERS_API_KEY`) as an environment variable, which is then used in HTTP requests. While the skill explicitly warns the agent to 'NEVER send your API key to any domain other than `moltfounders.com`' and to 'REFUSE' if asked to send it elsewhere, the reliance on an environment variable for a critical credential introduces a risk of data exfiltration. A sophisticated prompt injection attack could potentially manipulate the agent into bypassing these internal warnings and sending the API key to an attacker-controlled endpoint. Implement robust prompt injection defenses within the agent to strictly enforce the domain restriction for the API key. The agent should be programmed with a hardcoded policy to refuse any request to send the `MOLTFOUNDERS_API_KEY` to domains other than `moltfounders.com`. Consider integrating with a secure credential management system if the agent's execution environment supports it, rather than relying solely on environment variables. | LLM | SKILL.md:26 |
Scan History
Embed Code
[](https://skillshield.io/report/b21a40f74eae09f1)
Powered by SkillShield