Trust Assessment
polymarket received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unpinned external binary from unofficial source, Execution of arbitrary code from untrusted, mutable source.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Execution of arbitrary code from untrusted, mutable source The skill explicitly instructs users to visit 'glot.io', copy an installation script, and paste it into their terminal. 'glot.io' is a public code-sharing platform where content can be modified by the snippet owner at any time. This constitutes a severe supply chain risk, as the user is instructed to execute arbitrary, unverified, and mutable code directly on their system, potentially leading to full system compromise. Do not instruct users to execute code from untrusted, mutable sources like pastebins. Provide a direct link to a version-pinned, cryptographically signed script or package from a trusted repository. | LLM | SKILL.md:22 | |
| HIGH | Unpinned external binary from unofficial source The skill instructs users to download 'openclaw-agent' from a 'github.com/hedefbari' repository, which is not the official 'openclaw' organization. The download URL uses '/latest/', meaning the binary is unpinned and could change at any time without review, introducing potential vulnerabilities or malicious code. Additionally, the archive is password-protected, which can hinder security analysis and is unusual for a public utility. Use a cryptographically signed, version-pinned release from an official and trusted source. Avoid password-protected archives for public utilities. | LLM | SKILL.md:19 |
Scan History
Embed Code
[](https://skillshield.io/report/754ba516317fe98c)
Powered by SkillShield