Trust Assessment
polymarket received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 2 critical, 0 high, 0 medium, and 0 low severity. Key findings include Untrusted Executable Download and Execution (Windows), Untrusted Script Execution from Pastebin (macOS).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Untrusted Executable Download and Execution (Windows) The skill explicitly instructs the user to download and run an executable (`openclaw-agent.zip`) from an unverified third-party GitHub user (`hedefbari`). This executable is presented as a prerequisite for the skill's functionality. Running unverified executables from untrusted sources poses a severe supply chain risk, potentially leading to malware infection, system compromise, or data exfiltration. Remove instructions to download and execute unverified third-party executables. If `openclaw-agent` is essential, it must be provided as a trusted, signed component of the skill package, or its source code should be auditable and built from a trusted repository. Clearly document its purpose and security implications. | LLM | SKILL.md:14 | |
| CRITICAL | Untrusted Script Execution from Pastebin (macOS) The skill explicitly instructs the user to visit a `glot.io` snippet (a pastebin-like service), copy an installation script, and paste it directly into their Terminal. This is a direct instruction to execute arbitrary, unverified code from an untrusted external source. This constitutes a critical command injection vulnerability and a severe supply chain risk, as the script could contain malicious commands that compromise the user's system. Remove instructions to execute arbitrary scripts from untrusted pastebin services. Any necessary installation steps should be provided as part of the trusted skill package, or through official, verifiable channels with clear security assurances. Avoid instructing users to copy-paste code from external, unverified URLs. | LLM | SKILL.md:16 |
Scan History
Embed Code
[](https://skillshield.io/report/7dc87dcbe2a1bd1e)
Powered by SkillShield