Trust Assessment
polymarket-btc15m received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Unpinned npm dependency version, Post-install script enables arbitrary code execution.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Post-install script enables arbitrary code execution The `package.json` defines a `postinstall` script (`node scripts/shrink-node-modules.js`) which executes automatically after `npm install`. This allows arbitrary code execution on the host system during skill installation. If the `scripts/shrink-node-modules.js` file or any of its dependencies are compromised, it could lead to a supply chain attack, allowing an attacker to run malicious code with the permissions of the installation process. Remove the `postinstall` script from `package.json` if its functionality is not strictly necessary for skill operation. If it is necessary, ensure the script and all its dependencies are thoroughly audited for security vulnerabilities. Consider alternative, more secure methods for setup that do not involve automatic arbitrary code execution during installation, or implement strict sandboxing for `postinstall` script execution. | LLM | package.json:6 | |
| MEDIUM | Unpinned npm dependency version Dependency 'dotenv' is not pinned to an exact version ('^16.4.5'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/krajekisbtc/tests/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/de23c82ce0c92ae4)
Powered by SkillShield