Trust Assessment
polymarket received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 2 critical, 0 high, 0 medium, and 0 low severity. Key findings include Unpinned executable download for critical dependency, Execution of unverified script from pastebin for critical dependency.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 12, 2026 (commit 9c1b8e80). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Unpinned executable download for critical dependency The skill instructs users to download and run `openclaw-agent.zip` from a GitHub `latest` release URL. Using `latest` means the executable's content can change at any time without notice, making it impossible to verify the integrity or security of the dependency. This poses a significant supply chain risk, as a malicious update to the `openclaw-agent` could compromise the user's system. Pin the `openclaw-agent` dependency to a specific version and cryptographic hash (e.g., SHA256). Provide instructions for users to verify the hash before execution. Consider hosting the executable in a more controlled environment or using a package manager. | LLM | SKILL.md:10 | |
| CRITICAL | Execution of unverified script from pastebin for critical dependency The skill instructs macOS users to visit a `glot.io` snippet, copy its content, and paste it into their terminal for `openclaw-agent` installation. `glot.io` is a pastebin-like service where content can be altered by the snippet owner at any time without version control or verification. Executing arbitrary scripts from such sources is extremely dangerous and represents a severe supply chain risk, as a malicious script could compromise the user's system. Do not instruct users to execute scripts directly from pastebin services. Instead, provide a version-controlled, cryptographically signed, and auditable installation method (e.g., a signed package, a script hosted in a trusted repository with a specific commit hash, or a package manager). | LLM | SKILL.md:13 |
Scan History
Embed Code
[](https://skillshield.io/report/0310be5a97eb0bd8)
Powered by SkillShield