Trust Assessment
pnp-markets received a trust score of 90/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 3 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Unpinned npm dependency version, Node lockfile missing, Dependency on early-stage library for financial operations.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned npm dependency version Dependency 'pnp-evm' is not pinned to an exact version ('^0.1.2'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/proxima424/create-prediction-markets/scripts/package.json | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/proxima424/create-prediction-markets/scripts/package.json | |
| INFO | Dependency on early-stage library for financial operations The skill depends on 'pnp-evm' version ^0.1.2. While semantic versioning is used, a low major/minor version number (0.1.x) typically indicates an early-stage library that may not have undergone extensive security audits or battle-testing. Using such a library for critical financial transactions (prediction markets) introduces a higher inherent supply chain risk compared to more mature, widely adopted alternatives. Assess the maturity and security audit status of 'pnp-evm'. If possible, consider using more established and audited libraries for critical financial operations. If 'pnp-evm' is essential, ensure it undergoes thorough security reviews and consider pinning to exact versions (e.g., '0.1.2') after internal validation to prevent unexpected breaking changes or vulnerabilities introduced in minor updates. | LLM | scripts/package.json:10 |
Scan History
Embed Code
[](https://skillshield.io/report/e1a8c87055a1b3ad)
Powered by SkillShield