Trust Assessment
proxy-pay received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Skill instructs LLM to expose sensitive payment card details.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Skill instructs LLM to expose sensitive payment card details The skill explicitly instructs the LLM to call the `proxy.cards.get_sensitive` tool and then output the retrieved sensitive payment card details (Card Number, CVV, Expiry, Billing ZIP) directly to the user. This constitutes a severe data exfiltration risk, as financial credentials could be exposed in the LLM's conversational output. This also indicates an excessive permission for the skill or the underlying `proxy.cards.get_sensitive` tool if it allows such direct exposure of raw card data. Do not instruct the LLM to directly output sensitive payment card details. The `proxy.cards.get_sensitive` tool should ideally not return raw card details to the LLM, or the skill should be modified to only return a tokenized version or confirmation of card usage, not the full details. If card details are necessary for the user, they should be handled through a secure, out-of-band channel, not via the LLM's conversational output. | LLM | SKILL.md:36 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/proxyhq/proxy-pay/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/68ee62cdb06c5615)
Powered by SkillShield