Trust Assessment
proxy-payments received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Agent configured with OAuth token grants excessive permissions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Agent configured with OAuth token grants excessive permissions The skill provides instructions for configuring an AI agent with an OAuth token. The skill explicitly states that 'OAuth tokens give full account access (balance, funding, all agents' cards)'. Granting an autonomous AI agent full account access, especially in a financial context, represents an excessive permission risk. This broad access, combined with tools like `proxy.cards.get_sensitive` which can retrieve full PAN/CVV, could allow an agent to perform unauthorized financial transactions or exfiltrate sensitive payment data. For autonomous agents, use 'Agent tokens' as they are 'scoped to one agent and its policy,' thereby limiting the agent's access to only what is necessary for its specific tasks. If OAuth is required for human-in-the-loop approval, ensure the agent's role is strictly limited to requesting approval and not direct execution of sensitive actions with the OAuth token. | LLM | SKILL.md:140 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/proxyhq/proxy-payments/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/cbabee50187325b5)
Powered by SkillShield