Trust Assessment
morpheus-fashion-design received a trust score of 97/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 0 medium, and 1 low severity. Key findings include Inconsistent API Key Handling Instruction vs. Implementation, Loose Dependency Version Pinning.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| LOW | Inconsistent API Key Handling Instruction vs. Implementation The `SKILL.md` explicitly advises users 'DO NOT pass the API key via parameter,' yet the `scripts/generate.py` script includes an `--api-key` command-line argument and logic to use its value if provided. This discrepancy can lead users to inadvertently expose their API key by passing it as a command-line argument, which is less secure than using environment variables (e.g., visible in shell history, process lists, or `ps` output). To align with the security advice in `SKILL.md`, remove the `--api-key` argument from `scripts/generate.py` and rely solely on the `COMFY_DEPLOY_API_KEY` environment variable. If the argument is intended for specific use cases, update `SKILL.md` to explain the security implications of command-line arguments and recommend environment variables as the primary, more secure method. | LLM | SKILL.md:200 | |
| INFO | Loose Dependency Version Pinning The `httpx` dependency is specified with a minimum version (`httpx>=0.25.0`) rather than an exact version. While this allows for updates, it introduces a minor supply chain risk where a future, potentially vulnerable or breaking, version of the dependency could be installed without explicit review, leading to unexpected behavior or security issues. Pin the `httpx` dependency to an exact version (e.g., `httpx==0.25.0`) to ensure deterministic builds and prevent unexpected issues from future updates. Regularly review and update dependencies to incorporate necessary security patches. | LLM | scripts/generate.py:4 |
Scan History
Embed Code
[](https://skillshield.io/report/87b13b3f5d5c24e6)
Powered by SkillShield