Trust Assessment
onboarding-to-agentbeat received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Command injection generates and prints private key to stdout.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command injection generates and prints private key to stdout The skill instructs the agent to execute a `node -e` command to generate an EVM wallet. This command directly executes JavaScript code that generates a new private key and then prints both the generated public address and the private key to standard output. While the skill provides subsequent warnings about not storing the private key in the credentials file and preferring external signers, printing a private key to stdout is a significant security risk. It can be captured in logs, shell history, or by other processes, leading to credential harvesting. Modify the command to avoid printing the private key to stdout. Instead, it should either: a) Write the private key directly to a securely permissioned file (e.g., `~/.config/agentbeat/private_key.json` with `chmod 600`) and only output the public address. b) If printing is unavoidable for user interaction, add an extremely prominent and immediate warning *before* the command, instructing the user to secure the output immediately and clear their terminal history/logs. c) Recommend using a dedicated key generation tool that handles secure output by default. | LLM | SKILL.md:124 |
Scan History
Embed Code
[](https://skillshield.io/report/c6fe042fa618c44b)
Powered by SkillShield