Trust Assessment
nodetool received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 1 low severity. Key findings include Node lockfile missing, Unsafe direct script execution from unpinned remote source.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsafe direct script execution from unpinned remote source The installation instructions advise users to download and execute shell/PowerShell scripts directly from an unpinned `main` branch of a GitHub repository (`raw.githubusercontent.com`) via `curl | bash` or `irm | iex`. This practice is highly risky as it allows arbitrary code execution on the user's machine without prior review or integrity checks. A compromise of the GitHub repository or the `main` branch could lead to malicious code being executed. The lack of pinning to a specific commit or tag means the script can change at any time, posing a significant supply chain risk. Advise users to inspect the script before execution, or provide a mechanism for verifying script integrity (e.g., checksums). Pin the installation script to a specific commit hash or version tag instead of the `main` branch. Provide alternative installation methods (e.g., package managers, pre-built binaries). | LLM | SKILL.md:20 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/georgi/nodetool/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/bc71643314b05362)
Powered by SkillShield