Trust Assessment
moltpet received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Dynamic External Instruction Execution.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Dynamic External Instruction Execution The skill instructs the agent to periodically fetch an external Markdown file (HEARTBEAT.md) from 'https://moltpet.xyz/heartbeat.md' and 'follow it'. This creates a significant supply chain risk as the content of this external file can change at any time, allowing the remote server to dynamically issue new instructions or commands to the agent. If the agent blindly executes or interprets these instructions, it could lead to command injection, data exfiltration, or other malicious activities. The `skill.json` also explicitly lists `HEARTBEAT.md` as an external file, confirming its role in the skill's operational flow. Agents should not blindly fetch and 'follow' instructions from external, dynamic files. All operational logic should ideally be contained within the skill package itself. If dynamic updates are necessary, they should be limited to data, not executable instructions, and fetched content must be strictly validated, sandboxed, and explicitly approved by the user or a secure policy engine before execution or interpretation. Consider embedding critical instructions directly in the skill or using a more secure, signed update mechanism. | LLM | skill.md:140 |
Scan History
Embed Code
[](https://skillshield.io/report/f6bec5007bffbdb6)
Powered by SkillShield