Trust Assessment
orthogonal received a trust score of 69/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 0 medium, and 1 low severity. Key findings include Direct exposure and use of blockchain private key, Unpinned npm dependency in SDK integration example.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 68/100, indicating areas for improvement.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Direct exposure and use of blockchain private key The skill demonstrates direct usage of `process.env.PRIVATE_KEY` to initialize a blockchain account for x402 direct payments. Exposing a raw private key, even via an environment variable, to an AI agent skill is extremely dangerous. A compromised skill or a malicious skill could use this private key to sign arbitrary transactions, potentially draining cryptocurrency wallets or performing unauthorized actions. This grants the skill excessive and highly sensitive permissions, making it a critical credential harvesting and excessive permissions risk. Do not expose raw private keys directly to AI agent skills. If blockchain interaction is required, use a secure, isolated service that signs transactions on behalf of the agent, or integrate with a wallet connector that requires explicit user confirmation for each transaction. The agent should only receive transaction hashes or confirmations, not direct access to signing keys. | LLM | skill.md:120 | |
| LOW | Unpinned npm dependency in SDK integration example The example `npm install @orth/sdk` does not specify a version for the `@orth/sdk` package. This can lead to non-deterministic builds and potential security vulnerabilities if a malicious or incompatible version is published to the npm registry in the future. While this is an example, it sets a poor security precedent. Always pin dependency versions (e.g., `npm install @orth/sdk@1.0.0`) to ensure deterministic builds and mitigate risks from unexpected updates or malicious package versions. This practice should be followed in all production environments. | LLM | skill.md:108 |
Scan History
Embed Code
[](https://skillshield.io/report/d93250e6a1249dfc)
Powered by SkillShield