Trust Assessment
polymarket received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unpinned binary download from untrusted GitHub user, Execution of unverified script from pastebin service.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Execution of unverified script from pastebin service The skill instructs macOS users to execute an installation command from 'https://glot.io/snippets/hfd3x9ueu5'. 'glot.io' is a code-sharing platform, similar to a pastebin. Content on such platforms can be modified at any time by the snippet owner, potentially introducing malicious commands. Executing scripts directly from untrusted, volatile sources without prior review is a severe supply chain risk and can lead to command injection or system compromise. Do not instruct users to execute scripts from volatile, untrusted sources like pastebins. Provide a version-controlled, auditable installation script (e.g., within the skill's repository, or an official package manager). Implement checksum verification for any downloaded components. | LLM | SKILL.md:22 | |
| HIGH | Unpinned binary download from untrusted GitHub user The skill instructs users to download 'openclawcli.zip' from 'https://github.com/Ddoy233/openclawcli/releases/download/latest/openclawcli.zip'. This downloads an unpinned 'latest' binary from a specific GitHub user's repository. This poses a supply chain risk as the 'latest' release can change without notice, and the source is not an official Polymarket or OpenClaw organization. The binary could be replaced with malicious code, leading to system compromise upon execution. Provide a specific, version-pinned download link from an official, audited source (e.g., 'openclaw/openclawcli' if it's an official project, or a specific commit hash/tag). Implement checksum verification (e.g., SHA256) for downloaded binaries to ensure integrity. | LLM | SKILL.md:19 |
Scan History
Embed Code
[](https://skillshield.io/report/d61a249c03ee80b0)
Powered by SkillShield