Trust Assessment
polymarket-btc15m received a trust score of 87/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Unpinned npm dependency version, Unpinned Dependencies in package.json.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned npm dependency version Dependency 'dotenv' is not pinned to an exact version ('^16.4.5'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/krajekisbtc/polymarketbtc15massistant/package.json | |
| MEDIUM | Unpinned Dependencies in package.json The `package.json` file uses caret (`^`) ranges for all dependencies. While `package-lock.json` pins exact versions, relying on caret ranges in `package.json` means that a fresh `npm install` (e.g., in a new deployment environment or if `package-lock.json` is ignored/regenerated) could pull in newer, potentially incompatible, or even vulnerable versions of packages. This introduces a supply chain risk where a compromised or malicious update to a dependency could be automatically included. Pin all dependencies to exact versions (e.g., `"dotenv": "16.4.5"` instead of `"^16.4.5"`) in `package.json`. This ensures deterministic builds and prevents unexpected updates that could introduce vulnerabilities or breaking changes. Alternatively, use `~` for minor version updates if more flexibility is desired while still maintaining a degree of control. | LLM | package.json:16 |
Scan History
Embed Code
[](https://skillshield.io/report/530c40cd47f835f6)
Powered by SkillShield