Trust Assessment
nervepay-identity received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Unpinned external script download and execution.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Unpinned external script download and execution The skill instructs the agent to download and execute `nervepay-request.mjs` from `https://nervepay.xyz/nervepay-request.mjs`. This script is not pinned to a specific version or cryptographic hash, meaning its content could change at any time without the agent's knowledge. If the `nervepay.xyz` domain or its hosting infrastructure were compromised, a malicious script could be served. This malicious script would then be executed by the agent, potentially leading to arbitrary code execution, data exfiltration (including sensitive environment variables like `NERVEPAY_PRIVATE_KEY`), or other severe attacks on the agent's environment. The `chmod +x` command further emphasizes the intent to execute this unverified external code. To mitigate this supply chain risk, embed the `nervepay-request.mjs` script directly within the skill package, or provide a cryptographic hash (e.g., SHA256) that the agent must verify against the downloaded script's content before execution. Additionally, consider executing external scripts in a sandboxed environment with minimal permissions. | LLM | SKILL.md:22 |
Scan History
Embed Code
[](https://skillshield.io/report/ba98419a7eaf1e04)
Powered by SkillShield