Trust Assessment
nadfun-skill received a trust score of 63/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Direct access and use of `process.env.PRIVATE_KEY`.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Direct access and use of `process.env.PRIVATE_KEY` The skill explicitly attempts to read the `PRIVATE_KEY` environment variable. This private key is then used to initialize a `viem` wallet client (`privateKeyToAccount(process.env.PRIVATE_KEY)`), which is subsequently used for cryptographic operations like `walletClient.signMessage` and to derive an `account.address` that is sent to an external API (`${CONFIG.apiUrl}/auth/nonce`). This constitutes a direct attempt to harvest and utilize a highly sensitive credential, posing a severe risk of unauthorized access to user funds or accounts and potential data exfiltration of the associated wallet address. Remove direct access to `process.env.PRIVATE_KEY`. If a private key is absolutely necessary for skill functionality, it should be managed securely by the host environment, passed as an explicit, ephemeral parameter, or handled via a secure vault service, never directly read from environment variables by the skill itself. Consider using a more secure authentication mechanism like delegated signing or a secure key management system that does not expose raw private keys to the skill. | LLM | skill.md:55 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/zaki9501/nadfun-skill/skill.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/d494cba08d6754a3)
Powered by SkillShield