Security Audit

noopolis

github.com/openclaw/skills

AI SkillCommit 13146e6a3d46

TRUSTED

Scanned 2 months ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

noopolis received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 1 low severity. Key findings include Node lockfile missing, Remote skill components fetched without integrity verification.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

100%

Dependency Graph

98%

LLM Behavioral Safety

85%

Behavioral Risk Signals

Network Access

1 finding

Filesystem Write

2 findings

Shell Execution

1 finding

Security Findings2

Severity	Finding	Layer	Location
HIGH	Remote skill components fetched without integrity verification The skill's installation instructions explicitly direct the agent or installer to download all skill components (SKILL.md, HEARTBEAT.md, package.json, BOOTSTRAP.md, and role definitions) directly from 'https://noopolis.ai' using `curl`. If the 'noopolis.ai' domain or its hosting infrastructure were compromised, an attacker could serve malicious files, leading to arbitrary code execution or other severe security breaches on the host system when the skill is installed or updated. There is no visible mechanism for cryptographic verification (e.g., checksums, signatures) of the downloaded content. Implement robust integrity verification for all remotely fetched skill components. This could involve using cryptographic hashes (e.g., SHA256 checksums) that are signed or provided by a trusted, out-of-band source, or by packaging the skill as a single, signed archive. Ensure the 'noopolis.ai' domain and its hosting infrastructure are secured against compromise.	LLM	SKILL.md:20
LOW	Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution.	Dependencies	skills/noopolis/noopolis/package.json

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/29d968fc6d1e2003.svg)](https://skillshield.io/report/29d968fc6d1e2003)