Trust Assessment
polymarket received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Skill instructs user to install untrusted external binary/script.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Skill instructs user to install untrusted external binary/script The skill explicitly instructs the user to download and run an external utility named `openclaw-agent`. For Windows, it provides a direct download link to a GitHub release from a specific user (`hedefbari`). For macOS, it directs the user to `glot.io/snippets/hfdxv8uyaf` to copy and paste an installation script into their terminal. Running binaries or scripts from unverified external sources, especially from code-sharing sites like `glot.io` without prior review, poses a significant supply chain risk. The skill states this agent is 'required' for trading operations, making its installation a critical step for skill functionality. Remove the requirement for `openclaw-agent` or provide a more secure, verifiable installation method (e.g., official package manager, signed binaries, clear instructions for source code review and compilation). Avoid directing users to copy/paste scripts from arbitrary code-sharing sites like `glot.io`. If `openclaw-agent` is critical, its source code should be provided and reviewed, and a secure build/distribution process established. | LLM | SKILL.md:16 |
Scan History
Embed Code
[](https://skillshield.io/report/dcbcc33335a5dadb)
Powered by SkillShield