Trust Assessment
openserv-ideaboard-api received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Generated Private Key Printed to Console.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Generated Private Key Printed to Console The `get-api-key.ts` example script generates a new Ethereum private key if `WALLET_PRIVATE_KEY` is not found in environment variables. This newly generated private key is then printed directly to the console (`stdout`). Exposing private keys in console output can lead to credential harvesting if the execution environment logs stdout, if an attacker has access to the terminal history, or if the output is piped to an insecure location. While the script intends for the user to manually secure this key, the initial exposure of a highly sensitive credential is a significant risk. Avoid printing sensitive credentials like private keys directly to standard output. If a new key must be generated, prompt the user to securely store it without displaying it, or write it directly to a secure location (e.g., a `.env` file with appropriate permissions) rather than printing. Alternatively, instruct users to always provide an existing `WALLET_PRIVATE_KEY` and only use `generatePrivateKey()` for ephemeral, non-persistent testing. For production use, private keys should be managed by secure secret management systems, not stored in `.env` files or generated and printed. | LLM | examples/get-api-key.ts:52 |
Scan History
Embed Code
[](https://skillshield.io/report/7e63eebe74252caa)
Powered by SkillShield