Trust Assessment
paypal-integration received a trust score of 90/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Unpinned Python dependencies, Hardcoded PayPal IPN sandbox URL.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned Python dependencies The skill's Python code examples use `paypalrestsdk`, `requests`, and `flask` without specifying exact versions. This can lead to unexpected behavior, compatibility issues, or introduce security vulnerabilities if a future version of these libraries contains breaking changes or known exploits. It is a best practice to pin dependencies to specific versions to ensure consistent and secure deployments. Pin all Python dependencies to specific versions (e.g., `paypalrestsdk==X.Y.Z`, `requests==A.B.C`, `flask==P.Q.R`) in a `requirements.txt` file or similar dependency management system. Regularly review and update these pinned versions. | LLM | SKILL.md:50 | |
| MEDIUM | Hardcoded PayPal IPN sandbox URL The `verify_ipn` function in the IPN handling example hardcodes the PayPal IPN verification URL to `https://ipnpb.sandbox.paypal.com/cgi-bin/webscr`. If this code is deployed to a production environment without changing this URL to the live PayPal IPN endpoint, all IPN verifications will fail. This could lead to incorrect processing of payments or refunds, or potentially allow malicious IPNs to be accepted if the verification step is bypassed due to consistent failures. Make the PayPal IPN verification URL configurable (e.g., via environment variables or a configuration file) and ensure the correct production URL (`https://ipnpb.paypal.com/cgi-bin/webscr`) is used when deploying to a live environment. The skill itself highlights this as a 'Common Pitfall'. | LLM | SKILL.md:167 |
Scan History
Embed Code
[](https://skillshield.io/report/50171b3f8a115cf4)
Powered by SkillShield