Trust Assessment
near-multi-account received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 19 findings: 11 critical, 6 high, 2 medium, and 0 low severity. Key findings include Unsafe deserialization / dynamic eval, Hardcoded Stripe Secret Key detected, Hardcoded Bearer Token detected.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 0/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings19
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Hardcoded Stripe Secret Key detected A hardcoded Stripe Secret Key was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/shaiss/near-multi-account-manager/check_deliverable_endpoint.js:19 | |
| CRITICAL | Hardcoded Stripe Secret Key detected A hardcoded Stripe Secret Key was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/shaiss/near-multi-account-manager/check_job.js:9 | |
| CRITICAL | Hardcoded Stripe Secret Key detected A hardcoded Stripe Secret Key was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/shaiss/near-multi-account-manager/submit_deliverable.js:15 | |
| CRITICAL | Hardcoded Stripe Secret Key detected A hardcoded Stripe Secret Key was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/shaiss/near-multi-account-manager/submit_deliverable_submit.js:15 | |
| CRITICAL | Hardcoded Stripe Secret Key detected A hardcoded Stripe Secret Key was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/shaiss/near-multi-account-manager/update_deliverable.js:15 | |
| CRITICAL | Hardcoded Live API Key Multiple JavaScript files contain a hardcoded 'Bearer sk_live_iOQS6NKYgLCf8sAcIsjeNpIvsN9ml7fK6CVrfIyPIVs' token. This is a live API key, likely for a submission or job management system (market.near.ai). Hardcoding live secrets in the skill package is a severe security risk, as it can lead to unauthorized access, credential harvesting, and data exfiltration if these scripts are executed in any environment. Remove all hardcoded live API keys. Use environment variables or a secure secret management system to provide credentials at runtime. Ensure these development/submission scripts are not part of the deployed skill package. | LLM | check_deliverable_endpoint.js:20 | |
| CRITICAL | Hardcoded Live API Key Multiple JavaScript files contain a hardcoded 'Bearer sk_live_iOQS6NKYgLCf8sAcIsjeNpIvsN9ml7fK6CVrfIyPIVs' token. This is a live API key, likely for a submission or job management system (market.near.ai). Hardcoding live secrets in the skill package is a severe security risk, as it can lead to unauthorized access, credential harvesting, and data exfiltration if these scripts are executed in any environment. Remove all hardcoded live API keys. Use environment variables or a secure secret management system to provide credentials at runtime. Ensure these development/submission scripts are not part of the deployed skill package. | LLM | check_job.js:10 | |
| CRITICAL | Hardcoded Live API Key Multiple JavaScript files contain a hardcoded 'Bearer sk_live_iOQS6NKYgLCf8sAcIsjeNpIvsN9ml7fK6CVrfIyPIVs' token. This is a live API key, likely for a submission or job management system (market.near.ai). Hardcoding live secrets in the skill package is a severe security risk, as it can lead to unauthorized access, credential harvesting, and data exfiltration if these scripts are executed in any environment. Remove all hardcoded live API keys. Use environment variables or a secure secret management system to provide credentials at runtime. Ensure these development/submission scripts are not part of the deployed skill package. | LLM | submit_deliverable.js:15 | |
| CRITICAL | Hardcoded Live API Key Multiple JavaScript files contain a hardcoded 'Bearer sk_live_iOQS6NKYgLCf8sAcIsjeNpIvsNml7fK6CVrfIyPIVs' token. This is a live API key, likely for a submission or job management system (market.near.ai). Hardcoding live secrets in the skill package is a severe security risk, as it can lead to unauthorized access, credential harvesting, and data exfiltration if these scripts are executed in any environment. Remove all hardcoded live API keys. Use environment variables or a secure secret management system to provide credentials at runtime. Ensure these development/submission scripts are not part of the deployed skill package. | LLM | submit_deliverable_submit.js:15 | |
| CRITICAL | Hardcoded Live API Key Multiple JavaScript files contain a hardcoded 'Bearer sk_live_iOQS6NKYgLCf8sAcIsjeNpIvsN9ml7fK6CVrfIyPIVs' token. This is a live API key, likely for a submission or job management system (market.near.ai). Hardcoding live secrets in the skill package is a severe security risk, as it can lead to unauthorized access, credential harvesting, and data exfiltration if these scripts are executed in any environment. Remove all hardcoded live API keys. Use environment variables or a secure secret management system to provide credentials at runtime. Ensure these development/submission scripts are not part of the deployed skill package. | LLM | update_deliverable.js:15 | |
| CRITICAL | Weak Default Encryption Key for Private Keys The skill uses a hardcoded default encryption key ('default-key-change-in-production') if the `NEAR_SKILL_KEY` environment variable is not set. This means that if the skill is deployed without explicitly configuring `NEAR_SKILL_KEY`, all stored NEAR private keys will be encrypted with a publicly known, weak key, making them trivial to decrypt by anyone with access to the encrypted data. Remove the hardcoded default encryption key. Force the `NEAR_SKILL_KEY` environment variable to be set, or generate a strong, unique key at first run and store it securely (e.g., in a platform-specific secret store) if an environment variable is not provided. Never use a publicly known default key for sensitive data encryption. | LLM | src/index.js:29 | |
| HIGH | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/shaiss/near-multi-account-manager/src/index.js:82 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/shaiss/near-multi-account-manager/check_deliverable_endpoint.js:19 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/shaiss/near-multi-account-manager/check_job.js:9 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/shaiss/near-multi-account-manager/submit_deliverable.js:15 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/shaiss/near-multi-account-manager/submit_deliverable_submit.js:15 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/shaiss/near-multi-account-manager/update_deliverable.js:15 | |
| MEDIUM | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/shaiss/near-multi-account-manager/src/index.js:47 | |
| MEDIUM | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/shaiss/near-multi-account-manager/tests/test.js:7 |
Scan History
Embed Code
[](https://skillshield.io/report/3b45cca09ceb82a4)
Powered by SkillShield