Trust Assessment
paypal received a trust score of 95/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Skill requires `curl` binary, granting broad network access.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 9c1b8e80). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Skill requires `curl` binary, granting broad network access The skill's manifest declares a dependency on the `curl` binary. `curl` is a powerful command-line tool capable of making arbitrary network requests, which grants the skill broad network access. If the skill's implementation uses `curl` with unsanitized user-provided input, this capability could be exploited for data exfiltration, Server-Side Request Forgery (SSRF), or command injection. While network access is likely necessary for a PayPal integration, relying on a general-purpose tool like `curl` without explicit input sanitization and output validation introduces a significant attack surface. Review the skill's implementation to ensure `curl` is used only for intended purposes and all inputs to `curl` commands are rigorously sanitized. Consider if `curl`'s full capabilities are truly required, or if a more restricted and safer network access method (e.g., a dedicated HTTP client library with strict URL parsing) could be used. If `curl` is essential, implement strict input validation and output parsing, and consider sandboxing the execution environment. | LLM | SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/03a3999475592914)
Powered by SkillShield